Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening SSH with 2FA

gist.github.com

Post reply on HN
Print view View original

11–20 of 103 posts

Re: Hardening SSH with 2FA

#11

Post by _ytji »

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me.

I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself be in practice? (Am I being paranoid for NOT wanting to go the extra mile to ensure that I actually have access to my systems when I need it the most?)

Re: Hardening SSH with 2FA

#12

Post by idlewords »

jetrink wrote: post #8
idlewords wrote: post #7

Earlier quoted context omitted.

I'm not sure I understand what you mean. I run a one-person business and my servers are 110 miles away in Sacramento; what do I do if my yubikey breaks?

I think the SOP is to have a second Yubikey registered and stored in a safe place and/or a set of one-time codes that you can use instead.

I actually had no idea SSH had support for one-time passwords, but I see docs for OTPW here: https://www.digitalocean.com/community/tutorials/install-and...

This looks like exactly the answer I needed; thank you!

Re: Hardening SSH with 2FA

#13

Post by tptacek »

idlewords wrote: post #2

I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…

Easy: on each host you log into, you enter into authorized_keys your Yubikey RSA pubkey and a standard software SSH pubkey. The private key for the software keypair, you stick on a thumb drive and keep in a drawer or a safe or whatever.

Later

Sorry, I see below you're thinking about using Yubikeys in addition to keypairs. This obviously doesn't answer that question.

Re: Hardening SSH with 2FA

#15

Post by jplayer01 »

xaduha wrote: post #14

This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

Re: Hardening SSH with 2FA

#16

Post by tyingq »

_ytji wrote: post #11

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…

The Google auth PAM module is very straightforward: https://github.com/google/google-authenticator-libpam

You could run a separate instance of say, dropbear on another port as a failsafe, until you're comfortable. Or maybe firewall it off to a set of fixed source ips.

Re: Hardening SSH with 2FA

#17

Post by cmehdy »

jplayer01 wrote: post #15
xaduha wrote: post #14

This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

Some yubikeys provide smart-card functionality. https://www.yubico.com/solutions/smart-card/

Re: Hardening SSH with 2FA

#18

Post by xaduha »

jplayer01 wrote: post #15
xaduha wrote: post #14

This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

> USB tokens like a Yubikey

As far as I can tell first Yubikeys were basically small cardreaders with non-removable smartcards in SIM card formfactor.

> Wait, really? They still make these?

Every credit card with a chip is basically a smartcard, every SIM card too. Smart cards are not going anywhere.

> How do you interface with one of these?

CCID cardreader + OpenSC

Re: Hardening SSH with 2FA

#19

Post by kylek »

tyingq wrote: post #16
_ytji wrote: post #11

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…

The Google auth PAM module is very straightforward: https://github.com/google/google-authenticator-libpam You could run a separate instance of say, dropbear on another port as a failsafe, until you're comfortable. Or maybe firewall it off to a set of fixed source ips.

Neat, this might be the lowest-friction approach I've seen so far. (My distro even has a `libpam-google-authenticator` package to boot)

Re: Hardening SSH with 2FA

#20

Post by pm90 »

perlgeek wrote: post #5
idlewords wrote: post #2

I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…

> I'm also not sure of the rationale for having a bastion host It's a central place where you can do your logging, which many enterprises must do for compliance reasons.

Really? Do any compliance standards specifically require this? Or is the specific control defined in the organization itself that requires this?

I've found many compliance standards to be pretty open-ended and function-driven, rather than prescribing specific standards. Client contracts.... they may be a different beast, and often require specific promises by vendors.

Post reply on HN