Seriously? Another (virtual) token-based 2FA solution? What is your competitive advantage against Duo, Authentify, Entrust, and the thousand other SMS or virtual token 2FA solutions out there?
[deleted]
Add two-factor authentication to your ssh in 30 seconds
81–90 of 108 posts
Re: Add two-factor authentication to your ssh in 30 seconds
#82Earlier quoted context omitted.
Interestingly it appears this Authy method does not use PAM. I wonder if there is a reason for that, since a PAM module would be a good deal more flexible (this sort of thing is what PAM is for after all).
The basic reason is because we don't use passwords. We always use public/private certificates on all of our machines. With PAM you have to use passwords. We'll release a version soon that works with PAM, but I recommend you switch to using authorized_keys with certificates. Not only is it much more secure, it's also much nicer to use.
I do use authorized_keys, though PAM is good for a lot more than just sshd; that's why I say it is more flexible. For example, I could see two factor authentication being used to log into shared workstations through XDM/GDM. This would eliminate the possibility that your users are sharing passwords for their accounts.
Also, the way I would intend on using this is such that if your public key is in authorized_keys, you log in like normal. If not, you authenticate with PAM using both your unix password (or ldap or whatever you have configured) and your 2nd authentication system. I log into one or two of my servers from strange computers often enough that disabling password authentication entirely on those servers is limiting.
Re: Add two-factor authentication to your ssh in 30 seconds
#83Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…
The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.
If you use a google voice number you can just point it to a new phone.
Re: Add two-factor authentication to your ssh in 30 seconds
#84Earlier quoted context omitted.
The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.
Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication). If not, it might be possible to configure PAM with some sort of keys module set to 'sufficient', then have PAM fall back on two-factor auth paired with pam_unix. In fact, I'll see if I can get either of those wor…
Another option is to whitelist your ip address, and then require 2-factor auth only when you're connecting from a non-whitelisted ip address.
Of course this leaves you a vulnerable to ip spoofing, but adds a ton of convenience and could be a good trade-off.
Re: Add two-factor authentication to your ssh in 30 seconds
#85Fairly certain port forwarding still works while a command specified in ForceCommand is still running or if you specify a non-interactive shell.
Though I haven't checked ;)
Re: Add two-factor authentication to your ssh in 30 seconds
#86This is awesome. I wish the people at Authy the best. Now I'm gonna 2-factor auth the hell out of everything.
Re: Add two-factor authentication to your ssh in 30 seconds
#87Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…
Google Authenticator is pretty much a third-party service as well. Unless I'm mistaken in how Google Authentiator works - of course. If so, please fill in my blank :-)
You are mistaken. I'm not sure what blank to fill in. Google Auth use OATH for their two factor auth. Using the reference package just gives you their PAM module. It doesn't require hitting their servers or anything.
Re: Add two-factor authentication to your ssh in 30 seconds
#88Pretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/
the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?
Well, if that were the case, when I lose my phone (sadly, not if), I would be locked out of years of Google account data. Fortunately there are backup codes. (And for Google a phone number call/text recovery path).
Re: Add two-factor authentication to your ssh in 30 seconds
#89Seriously? Another (virtual) token-based 2FA solution? What is your competitive advantage against Duo, Authentify, Entrust, and the thousand other SMS or virtual token 2FA solutions out there?
We make it really easy for anyone to use 2FA. The reason 2FA is not popular is not because there aren't enough solutions out there, it's because all of them are basically really hard to use. Specially those that claim to be easy, they are the opposite.
A valid goal, but I think you're misunderstanding your market: in your words, people don't use 2FA because it's hard to use -- not hard to implement. Organizations who have IT teams are fully capable of implementing reasonable APIs like what Duo or Google offers. But you'll realize that enterprises don't even care about the architecture, because they'll be paying you to implement it anyway.
No, the reason nobody (in and only in the US) uses 2FA (because nearly every other country in the world uses it widely) is because it's a pain to use for the end user. No enterprise is going to invest their time and energy into a solution unless they're either required to by regulations or is truly better, easier, more secure, or whatever than competing solutions to make it a compelling sale.
If this were a hobby project then I'd be cheering you on -- why not make a token 2FA with a slightly better API? But as a YC-funded company whose likely avenue of success will be through the enterprise market, you NEED to develop a product that is better, faster, easier, more secure, etc than your (rather formidable) competition.
Trust me, I'm familiar with this market ;).
Re: Add two-factor authentication to your ssh in 30 seconds
#90If you are looking for a clean reliable two-factor auth system, I highly recommend Duo: http://www.duosecurity.com/ I've been using them across a half dozen personal machines for quite a while now, looking to roll it out at work as well.
Right, Duo is great. Love the fact you can install it over the whole enterprise including applications, blogs (Wordpress), vpns, and ssh.