Using two-factor authentication for SSH • Hacker News Board

Re: Using two-factor authentication for SSH

#11

Post by georgyo » Tue, Jan 12, 2016, 5:07 PM UTC

The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers.

A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this...

Re: Using two-factor authentication for SSH

#12

Post by n1000 » Tue, Jan 12, 2016, 5:21 PM UTC

georgyo wrote: post #11

The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers. A simpler and more robust method is SSH Keys + Passwords. I shou…

> A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this...

please do!

Re: Using two-factor authentication for SSH

#13

Post by zokier » Tue, Jan 12, 2016, 5:34 PM UTC

georgyo wrote: post #11

The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers. A simpler and more robust method is SSH Keys + Passwords. I shou…

Isn't that problem solved by using centralized authentication server instead of distributing the authentication material on individual servers? I imagine that would be best practice regardless of authentication method.

Re: Using two-factor authentication for SSH

#14

Post by nickik » Tue, Jan 12, 2016, 5:41 PM UTC

aroch wrote: post #9

nickik wrote: post #6

Earlier quoted context omitted.

You can use Yubico OTP as you 2 Factor for SSH. As far as I know you can not use U2F as a 2 Factor over SSH because it needs support from OpenSSH (or whatever). A patch does exist, however, it is not yet upstream (any information on this welcome). However in the absence of U2F, you can still use Yubico OTP (HOTP) or you can use your yubikey together with your smartphone for TOTP. I think its a bad idea to use your sm…

You can use yubi's PAM modules in conjunction with SSH PAM auth, no need to patch OpenSSH. https://developers.yubico.com/yubico-pam/

For Yubikey OTP, not U2F.

Re: Using two-factor authentication for SSH

#15

Post by ewindisch » Tue, Jan 12, 2016, 5:44 PM UTC

A far more simple solution is to require both SSH key and password. Something you have (a key) and something you know. You can even store your ssh key on a Yubikey, if you'd like.

Re: Using two-factor authentication for SSH

#16

Post by doublerebel » Tue, Jan 12, 2016, 5:51 PM UTC

I've been using Duo Security to add 2FA on SSH and other services on my SmartOS instances. It's really easy and the price is pretty low compared to the amount of work it would take to manage the keys and manual implementations.

In theory I could worry about Duo going down, but I also rely on other critical cloud services and do have other ways to access an instance in an emergency (and Duo supports fallbacks).

Simplicity can be deceiving. In this case I think leaving security to the pros is worth the tradeoff. I've previously relied on cloud services for secure user management and wasn't let down.

Re: Using two-factor authentication for SSH

#17

Post by Leszek » Tue, Jan 12, 2016, 5:53 PM UTC

PTRFRLL wrote: post #10

Authy provides something similar, I wonder if one is better than the other. https://github.com/authy/authy-ssh

I don't really understand authy: does it not keep your 2FA tokens in "the cloud" behind a password? Therefore, does this not make them equivalent to a password, and negate the whole point of 2FA?

Re: Using two-factor authentication for SSH

#18

Post by 1ace » Tue, Jan 12, 2016, 5:57 PM UTC

PTRFRLL wrote: post #10

Authy provides something similar, I wonder if one is better than the other. https://github.com/authy/authy-ssh

`authy-ssh` is much more advanced, but costs if you want over 3 authentications per day: https://www.authy.com/product/pricing/

Re: Using two-factor authentication for SSH

#19

Post by jszymborski » Tue, Jan 12, 2016, 6:04 PM UTC

Leszek wrote: post #17

PTRFRLL wrote: post #10

Authy provides something similar, I wonder if one is better than the other. https://github.com/authy/authy-ssh

I don't really understand authy: does it not keep your 2FA tokens in "the cloud" behind a password? Therefore, does this not make them equivalent to a password, and negate the whole point of 2FA?

I believe that functionality is opt-in (or a very prominent opt-out process), but yes I would say you no longer "have" the key, but are turning it into "knowing" a password required to retrieve the key.

Still Zero-Knowledge, but no longer really 2FA.

I still us Authy for a lot of my keys because (1) I have that cloud function off and (2) the UI is better than GA IMHO.

Re: Using two-factor authentication for SSH

#20

Post by jszymborski » Tue, Jan 12, 2016, 6:04 PM UTC

Leszek wrote: post #17

PTRFRLL wrote: post #10

Authy provides something similar, I wonder if one is better than the other. https://github.com/authy/authy-ssh

I don't really understand authy: does it not keep your 2FA tokens in "the cloud" behind a password? Therefore, does this not make them equivalent to a password, and negate the whole point of 2FA?

I believe that functionality is opt-in (or a very prominent opt-out process), but yes I would say you no longer "have" the key, but are turning it into "knowing" a password required to retrieve the key.

Still Zero-Knowledge, but no longer really 2FA.

I still us Authy for a lot of my keys because (1) I have that cloud function off and (2) the UI is better than GA IMHO.