Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

11–20 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#11

Post by 0x0 »

dcu wrote: post #5
pejoculant wrote: post #4

Pretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

If you mean lose access to the server, then the google-authenticator sets you up with a few emergency one-time codes you could write down on a note and keep safe, in case your phone is lost.

Re: Add two-factor authentication to your ssh in 30 seconds

#12

Post by subway »

You should really package this up, and provide a signed repo instead of relying on the busted SSL infrastructure and GitHub to provide security to your users.

While this one isn't quite as offensive as some, all these curl/sudo/bash combos really make me sad, particularly when used to "increase" security.

Re: Add two-factor authentication to your ssh in 30 seconds

#13

Post by seanponeil »

mryan wrote: post #8
pejoculant wrote: post #4

Pretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/

Seconding the recommendation for PAM/Google Authenticator. Off-topic: Has anyone ever managed to get PAM/Google Authenticator working with RADIUS? I spent a while messing about with this last year, and never got it working exactly as I had hoped. I'm no longer working with RADIUS, but this post reminded me I never finished scratching that geeky itch.

I can't speak for Google Authenticator but Duo works great with RADIUS http://www.duosecurity.com/docs/radius

Re: Add two-factor authentication to your ssh in 30 seconds

#16

Post by natrius »

mbreese wrote: post #9
dcu wrote: post #5

Earlier quoted context omitted.

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

It's two-factor authentication: something you have (phone) and something you know (password to your ssh cert). So, you have to lose both in order to lose the server.

I don't think this is the case. Losing either loses the server in the sense that you won't be able to access it. The fix is that the "something you have" is both your phone and emergency codes.

Re: Add two-factor authentication to your ssh in 30 seconds

#17

Post by danielpal »

eslachance wrote: post #14

This is great but one thing bugs me. When you add a new user, you have to restart SSH? Wouldn't that prevent people from connecting every time a new user is added?

No, when you add a new user you don't need to restart. Only restart the server when you install the plugin.

Re: Add two-factor authentication to your ssh in 30 seconds

#18

Post by stcredzero »

Has anyone added this to other than a server? Seems like this could be added to a notebook or desktop running OS X. (And for that, I would actually prefer Google Authenticator.)

Also, it occurs to me: With TFA, it finally makes sense to periodically change passwords.

Re: Add two-factor authentication to your ssh in 30 seconds

#19

Post by danielpal »

subway wrote: post #12

You should really package this up, and provide a signed repo instead of relying on the busted SSL infrastructure and GitHub to provide security to your users. While this one isn't quite as offensive as some, all these curl/sudo/bash combos really make me sad, particularly when used to "increase" security.

You are right. Best for your infrastructure is to fork it and modify it. We for example have a different version we use for chef and that already include everyone's keys.
Post reply on HN