91–100 of 108 posts
If somebody went through the trouble of owning your machine, can't they bypass the two-factor as well? Yes, it requires a more "live" and target attack, but one would think ssh attacks like these are pretty targeted in the first place. Or? What am I missing?
Earlier quoted context omitted.
Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.
Those who don't write it down deserve to be locked out. I've written down mine on three different pieces of paper (in my wallet, my bag and my closet), and also took a screenshot from it and `gpg`-ed it (with a passphrase, so no one can open it unless they know the password) and stored it in a few online repositories, as well as a friend's mailbox. So, I'll never be locked out from my account.
Earlier quoted context omitted.
Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication). If not, it might be possible to configure PAM with some sort of keys module set to 'sufficient', then have PAM fall back on two-factor auth paired with pam_unix. In fact, I'll see if I can get either of those wor…
Another option is to whitelist your ip address, and then require 2-factor auth only when you're connecting from a non-whitelisted ip address. Of course this leaves you a vulnerable to ip spoofing, but adds a ton of convenience and could be a good trade-off.
But that's correct, in recent openssh versions, it seems that you can add specific-host-only rules for authentication etc.
Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…
Thanks for the instructions, I like the fact that Google Authenticator doesn't need to contact their servers (or at least that's how I understand it). Sounds like you could preserve the use of SSH public key authentication by using Google Authenticator in combination with a ForceCommand; I'll have to look in to that. Anyone set up Google Authenticator to only challenge me on a host every N minutes or something like t…
Earlier quoted context omitted.
What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.
And how do you do that with cloud instances? :)
Earlier quoted context omitted.
The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.
If you use a google voice number you can just point it to a new phone.
Earlier quoted context omitted.
If you mean lose access to the server, then the google-authenticator sets you up with a few emergency one-time codes you could write down on a note and keep safe, in case your phone is lost.
I don't think google-authenticator does that, I think Gmail does that.
http://code.google.com/p/google-authenticator/source/browse/...
Earlier quoted context omitted.
Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.
My scratch codes are in 1Password (for my personal accounts) and LastPass (for work accounts).
Hm, can somebody explain what threat two-factor ssh-login is a response to? If somebody went through the trouble of owning your machine, can't they bypass the two-factor as well? Yes, it requires a more "live" and target attack, but one would think ssh attacks like these are pretty targeted in the first place. Or? What am I missing?
Who talks about a machine that is owned? This is about an additional requirement to log on to a service, be it ssh or email. Whether you're reusing your password, sharing it or just use a really bad one this adds an additional step to impersonate you.