Simple Two-Factor SSH Authentication • Hacker News Board

Re: Simple Two-Factor SSH Authentication

#11

Post by moomerman » Fri, Sep 23, 2011, 1:20 PM UTC

jaryd wrote: post #10

Could a user bypass this by using: ssh user@host.com -Tv 'bash' ?

Just tried it and it still prompts for the auth code

Re: Simple Two-Factor SSH Authentication

#12

Post by jaryd » Fri, Sep 23, 2011, 1:32 PM UTC

moomerman wrote: post #11

jaryd wrote: post #10

Could a user bypass this by using: ssh user@host.com -Tv 'bash' ?

Just tried it and it still prompts for the auth code

Thanks for the follow up! Will continue to play with it.

Re: Simple Two-Factor SSH Authentication

#13

Post by munin » Fri, Sep 23, 2011, 1:38 PM UTC

if you exec the shell on your own (and make auth decisions on your own) outside of PAM you are basically destroying meaningful logging of successful/unsuccessful authentication, right?

Re: Simple Two-Factor SSH Authentication

#14

Post by teeray » Fri, Sep 23, 2011, 1:43 PM UTC

GRC's Perfect Paper Passwords works well for me (https://www.grc.com/ppp.htm). It's similar to Last Pass's Grid authentication but less obnoxious IMO. One member of the GRC newsgroups has written a PAM which has served all of my 2FA needs (http://code.google.com/p/ppp-pam/).

Re: Simple Two-Factor SSH Authentication

#15

Post by corin_ » Fri, Sep 23, 2011, 2:04 PM UTC

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config:

  Match group yubikey
  #       ForceCommand /usr/local/bin/yubikey.sh
         ForceCommand /usr/local/bin/mobileverification.sh

The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey

And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number that user has saved in ~/.ssh/mobile_number and asks them to enter it.

Edit: in case anyone is interested, mobileverification.sh at http://pastie.org/pastes/2579517/text?key=tv1xciwdubnwi165fz... and yubikey.sh at http://pastie.org/pastes/2579528/text?key=krpmwrivbvrjmx0xb3...

Edit2: It's worth pointing out that both those scripts were written fairly quickly by me, for basic personal use. If you want to use them I would recommend going through them and making sure I didn't screw anything up.

Re: Simple Two-Factor SSH Authentication

#16

Post by moomerman » Fri, Sep 23, 2011, 2:13 PM UTC

corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

Cool examples - thanks.

Re: Simple Two-Factor SSH Authentication

#17

Post by ntoshev » Fri, Sep 23, 2011, 2:13 PM UTC

moomerman wrote: post #8

mise wrote: post #7

I got a certificate warning when opening the page.

Interesting, would you mind letting me know which browser/version you're running? and the error message if possible?

I got it with Dolphin browserr on Android 2.2, but didn't read it and can't get it anymore after I clicked "continue".

Re: Simple Two-Factor SSH Authentication

#18

Post by helper » Fri, Sep 23, 2011, 2:32 PM UTC

corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

We use duosecurity.com to do essentially the same thing. It supports text messaging and also has iPhone and Android apps. And its free upto 10 users.

Re: Simple Two-Factor SSH Authentication

#19

Post by ominous_prime » Fri, Sep 23, 2011, 2:38 PM UTC

munin wrote: post #13

if you exec the shell on your own (and make auth decisions on your own) outside of PAM you are basically destroying meaningful logging of successful/unsuccessful authentication, right?

You can log the events yourself. If it's a shell script, it would be as easy as:

    logger -p authpriv.notice "Some message about authentication"

Re: Simple Two-Factor SSH Authentication

#20

Post by zobzu » Fri, Sep 23, 2011, 2:41 PM UTC

corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

These are much more sensible that the OP's solution.

Just to be clear to anyone reading, because it's not really explained:

* OP double-protects the SSH key. It means you need the key's passphrase and another factor (Google authenticator) to decrypt the ssh key. Then the ssh key is used to auth with the server.

=> the authentication with the server is still one factor auth, compromising the key at any level still grants access.

=> obligatory analogy: OP did like that: put your car key in a box that also has a key. Attacker just need a copy of the key in the box to open the door (granted that he won't use any physical attack on the door :p)

=> 2 (or more) factor authentication should always be used on the component that does the final authentication.

* People using ForceCommand apply the 2 factor at the last step of authentication, that is, once the ssh key authenticated you correctly, you still need to authenticate to something else before being given access.

=> obligatory analogy: now you have a key and a cellphone. you turn the key in the car and the door doesn't fully unlock. you gotta enter a code given by the cellphone before it actually opens. if the attacker get a copy of your key, it's not enough. if the attacker gets a copy of your phone's passcode (even thus it changes each time), its not enough.