Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

71–80 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#71

Post by Ralith »

jlgreco wrote: post #34
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

Interestingly it appears this Authy method does not use PAM. I wonder if there is a reason for that, since a PAM module would be a good deal more flexible (this sort of thing is what PAM is for after all).

Most probably, they didn't know about PAM.

Re: Add two-factor authentication to your ssh in 30 seconds

#72

Post by pixelcort »

count wrote: post #69
dalore wrote: post #68

Earlier quoted context omitted.

What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.

And how do you do that with cloud instances? :)

Some VPS providers offer "console" access to the machine, which would probably allow someone to drop down into single user mode.

http://www.linode.com/faq.cfm#do-you-provide-console-access

Re: Add two-factor authentication to your ssh in 30 seconds

#74

Post by a_bonobo »

jimktrains2 wrote: post #73
cmsj wrote: post #37

In the video I see a private key coming from a Dropbox folder :( Missing. The. Point.

I didn't watch the video, but if the key is encrypted (password protected) like it should be, what's the problem?

In the comments the author states that his private key is inside a TrueCrypt-folder, and that folder is on Dropbox.

I know that's reasonably secure but it feels terrible.

Re: Add two-factor authentication to your ssh in 30 seconds

#75

Post by danielpal »

Ralith wrote: post #71
jlgreco wrote: post #34

Earlier quoted context omitted.

Interestingly it appears this Authy method does not use PAM. I wonder if there is a reason for that, since a PAM module would be a good deal more flexible (this sort of thing is what PAM is for after all).

Most probably, they didn't know about PAM.

Not at all. We understand PAM and we plan to release a version that works with PAM. But we don't like passwords, we much rather use public/private ssh keys instead of users with passwords. It's not only much better user experience but is also much more secure.

Re: Add two-factor authentication to your ssh in 30 seconds

#76

Post by danielpal »

jlgreco wrote: post #34
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

Interestingly it appears this Authy method does not use PAM. I wonder if there is a reason for that, since a PAM module would be a good deal more flexible (this sort of thing is what PAM is for after all).

The basic reason is because we don't use passwords. We always use public/private certificates on all of our machines. With PAM you have to use passwords. We'll release a version soon that works with PAM, but I recommend you switch to using authorized_keys with certificates. Not only is it much more secure, it's also much nicer to use.

Re: Add two-factor authentication to your ssh in 30 seconds

#77

Post by mbq »

One more option is Barada PAM module+Android app. http://barada.sourceforge.net/ It is basically a HOTP implementation, where the token is protected by PIN (with PIN being a missing part of the shared secret stored on the token) and the original password is reserved only to be used on trusted machines (or) in case of losing token.

Re: Add two-factor authentication to your ssh in 30 seconds

#78

Post by pooriaazimi »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

Those who don't write it down deserve to be locked out.

I've written down mine on three different pieces of paper (in my wallet, my bag and my closet), and also took a screenshot from it and `gpg`-ed it (with a passphrase, so no one can open it unless they know the password) and stored it in a few online repositories, as well as a friend's mailbox.

So, I'll never be locked out from my account.

Re: Add two-factor authentication to your ssh in 30 seconds

#79

Post by tedunangst »

jimktrains2 wrote: post #73
cmsj wrote: post #37

In the video I see a private key coming from a Dropbox folder :( Missing. The. Point.

I didn't watch the video, but if the key is encrypted (password protected) like it should be, what's the problem?

ssh key encryption isn't "lengthened" (it turns the password into the encryption key in the most obvious way possible). Unless your password is of the epic norse poem variety, it's crackable.

Re: Add two-factor authentication to your ssh in 30 seconds

#80

Post by danielpal »

aclimatt wrote: post #64

Seriously? Another (virtual) token-based 2FA solution? What is your competitive advantage against Duo, Authentify, Entrust, and the thousand other SMS or virtual token 2FA solutions out there?

We make it really easy for anyone to use 2FA. The reason 2FA is not popular is not because there aren't enough solutions out there, it's because all of them are basically really hard to use. Specially those that claim to be easy, they are the opposite.
Post reply on HN