Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#61

Post by mbreese »

natrius wrote: post #16
mbreese wrote: post #9

Earlier quoted context omitted.

It's two-factor authentication: something you have (phone) and something you know (password to your ssh cert). So, you have to lose both in order to lose the server.

I don't think this is the case. Losing either loses the server in the sense that you won't be able to access it. The fix is that the "something you have" is both your phone and emergency codes.

In security, losing the server doesn't mean losing access to the server. Losing the server means that someone else has access to the server, as in an adversary.

Yes, if you lose either factor, you can't access the server. This is why with Google Authenticator you also get a one time pad with emergency codes. However, I don't know how well this would work with two-factor SSH... you'd need a separate one time pad for each server. And I'm not sure how the Google PAM module handles emergency codes.

Re: Add two-factor authentication to your ssh in 30 seconds

#62

Post by jordibunster »

0x0 wrote: post #11
dcu wrote: post #5

Earlier quoted context omitted.

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

If you mean lose access to the server, then the google-authenticator sets you up with a few emergency one-time codes you could write down on a note and keep safe, in case your phone is lost.

I don't think google-authenticator does that, I think Gmail does that.

Re: Add two-factor authentication to your ssh in 30 seconds

#63

Post by peterwwillis »

danielweber wrote: post #54
peterwwillis wrote: post #51

Earlier quoted context omitted.

Can I quote you on that when the first "flaw in SMS used to circumvent two factor authentication" article comes out? A secured data connection is much better than SMS and easy to implement. But this is still a 'something you send' factor, which can be intercepted. A physical token or 'something you have' is more secure, and can also be easily implemented with a YubiKey, a paypal/ebay authentication card, etc. If you…

In order for a flaw in SMS to break someone in, the attacker would need to break both SMS and the traditional authentication channel. Yes, SMS can be broken. I'm sure Google Authenticator is vulnerable to certain attacks, too. Using them is better than throwing your hands up in the air and saying "it's not perfect, we'd better not implement it because then people will act as if they have perfect security!" Because pe…

You know this is the same reason people keep using telnet to manage their routers. "To attack the protocol would be like totally hard, and upgrading the routers to use ssh would be a pain in the ass. Telnet isn't perfect but it's better than nothing!"

Yeah, SMS isn't perfect, and yeah, it's better than nothing. But you know what else is better than nothing? Properly implemented TLS from an app or website on the phone. Of course that has holes too, but it's encrypted and (hopefully) authenticated unlike SMS. And it's available in every phone that can do SMS (unless you don't pay for data).

You can do whatever you want. But if you give people a crappy option and a good option, and the crappy option is slightly easier, they'll use the crappy option. But if they want the extra security they'll use the extra click it takes to make the good option work. Most people will just reason that nobody will ever use a keylogger on them and keep using keys with passwords.

Re: Add two-factor authentication to your ssh in 30 seconds

#66

Post by vegardx »

ikonst wrote: post #55
danielpal wrote: post #28

Earlier quoted context omitted.

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

I use ssh keys with this setup. If I login with an ssh key, I don't need the OTP.

How did you manage to do this? You'd have to use PAM for this to work, and PAM and key-based authentication is mutually exlusive, as far as I know.

Re: Add two-factor authentication to your ssh in 30 seconds

#67

Post by dalore »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

Mine are printed out and stored in my safe. They are never used.

Re: Add two-factor authentication to your ssh in 30 seconds

#68

Post by dalore »

danielpal wrote: post #28
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.

Re: Add two-factor authentication to your ssh in 30 seconds

#69

Post by count »

dalore wrote: post #68
danielpal wrote: post #28

Earlier quoted context omitted.

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.

And how do you do that with cloud instances? :)

Re: Add two-factor authentication to your ssh in 30 seconds

#70

Post by Ralith »

count wrote: post #69
dalore wrote: post #68

Earlier quoted context omitted.

What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.

And how do you do that with cloud instances? :)

Same way you do when you forget the root password on a normal configuration.
Post reply on HN