Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

101–108 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#101

Post by gizzlon »

darklajid wrote: post #100
gizzlon wrote: post #91

Hm, can somebody explain what threat two-factor ssh-login is a response to? If somebody went through the trouble of owning your machine, can't they bypass the two-factor as well? Yes, it requires a more "live" and target attack, but one would think ssh attacks like these are pretty targeted in the first place. Or? What am I missing?

Maybe I'm missing some assumptions of yours, but for me the reason to do that is to .. protect the ssh login. Who talks about a machine that is owned? This is about an additional requirement to log on to a service, be it ssh or email. Whether you're reusing your password, sharing it or just use a really bad one this adds an additional step to impersonate you.

Yeah, but you can log-in with private keys instead of passwords, so that problem was solved a long time ago.

Re: Add two-factor authentication to your ssh in 30 seconds

#102

Post by pja »

drivebyacct2 wrote: post #87
ersii wrote: post #42

Earlier quoted context omitted.

Google Authenticator is pretty much a third-party service as well. Unless I'm mistaken in how Google Authentiator works - of course. If so, please fill in my blank :-)

You are mistaken. I'm not sure what blank to fill in. Google Auth use OATH for their two factor auth. Using the reference package just gives you their PAM module. It doesn't require hitting their servers or anything. http://code.google.com/p/google-authenticator/

If you run google-authenticator with no arguments it hits Google's servers in order to generate a QRcode for your phone to scan.

So you are in fact handing over your 2-factor auth key to Google when you run google-authenticator. There's no actual need for the binary to do this (although it obviously makes the key entry on the phone much less error-prone) and there don't seem to be any command line arguments that would turn it off either. doesn't do this at all -- see below. (can I do strikethrough on HN?)

Re: Add two-factor authentication to your ssh in 30 seconds

#103

Post by mryan »

pja wrote: post #102
drivebyacct2 wrote: post #87

Earlier quoted context omitted.

You are mistaken. I'm not sure what blank to fill in. Google Auth use OATH for their two factor auth. Using the reference package just gives you their PAM module. It doesn't require hitting their servers or anything. http://code.google.com/p/google-authenticator/

If you run google-authenticator with no arguments it hits Google's servers in order to generate a QRcode for your phone to scan. So you are in fact handing over your 2-factor auth key to Google when you run google-authenticator. There's no actual need for the binary to do this (although it obviously makes the key entry on the phone much less error-prone) and there don't seem to be any command line arguments that woul…

    So you are in fact handing over your 2-factor auth key to Google when
    you run google-authenticator
Unless things have changed a lot since I last used this, this is not entirely correct. The binary will print out a URL - the QR code is only generated if you hit this URL.

If you visit this URL, you are sending the "QR-encoded" (not exactly, but you know what I mean) version of the key to Google's servers.

As long as you do not visit this link, you will not send your key to Google's servers.

Re: Add two-factor authentication to your ssh in 30 seconds

#104

Post by pja »

pja wrote: post #102
drivebyacct2 wrote: post #87

Earlier quoted context omitted.

You are mistaken. I'm not sure what blank to fill in. Google Auth use OATH for their two factor auth. Using the reference package just gives you their PAM module. It doesn't require hitting their servers or anything. http://code.google.com/p/google-authenticator/

If you run google-authenticator with no arguments it hits Google's servers in order to generate a QRcode for your phone to scan. So you are in fact handing over your 2-factor auth key to Google when you run google-authenticator. There's no actual need for the binary to do this (although it obviously makes the key entry on the phone much less error-prone) and there don't seem to be any command line arguments that woul…

Can't reply to mryan, but I'd just checked this before coming back to HN & indeed, google-authenticator doesn't make any network connections when invoked & it generates the QR-code locally.

So don't hit that URL if you don't want Google to know your 2-factor auth data!

Re: Add two-factor authentication to your ssh in 30 seconds

#105

Post by danielpal »

jlgreco wrote: post #82
danielpal wrote: post #76

Earlier quoted context omitted.

The basic reason is because we don't use passwords. We always use public/private certificates on all of our machines. With PAM you have to use passwords. We'll release a version soon that works with PAM, but I recommend you switch to using authorized_keys with certificates. Not only is it much more secure, it's also much nicer to use.

I do use authorized_keys, though PAM is good for a lot more than just sshd; that's why I say it is more flexible. For example, I could see two factor authentication being used to log into shared workstations through XDM/GDM. This would eliminate the possibility that your users are sharing passwords for their accounts. Also, the way I would intend on using this is such that if your public key is in authorized_keys, yo…

Yeah we'll release a PAM module soon so you can do this. If you don't want to wait, you could write one. Just look at this module, it's fairly simple. The API is really straight forward.

Re: Add two-factor authentication to your ssh in 30 seconds

#106

Post by ikonst »

justincormack wrote: post #96
gregwebs wrote: post #83

Earlier quoted context omitted.

If you use a google voice number you can just point it to a new phone.

Don't you need to login to do that? Using 2 factor auth..

Yes, so use your backup keys, or a secondary phone number, or a secondary email address... plenty of options.

Re: Add two-factor authentication to your ssh in 30 seconds

#108

Post by duaneb »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

> Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

This is your problem. I keep mine (for multiple services) in my wallet, and it's worked out excellently.

Post reply on HN