Simple Two-Factor SSH Authentication • Hacker News Board

Re: Simple Two-Factor SSH Authentication

#21

Post by ismarc » Fri, Sep 23, 2011, 2:44 PM UTC

moomerman wrote: post #8

mise wrote: post #7

I got a certificate warning when opening the page.

Interesting, would you mind letting me know which browser/version you're running? and the error message if possible?

I got the same thing on the default browser for Android 2.3, it shows the certificate was issued 9 17 2006 but expires 9 17 1936 (not sure if that's cert or CA) issued by startcom.

Re: Simple Two-Factor SSH Authentication

#22

Post by moomerman » Fri, Sep 23, 2011, 2:50 PM UTC

zobzu wrote: post #20

corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

These are much more sensible that the OP's solution. Just to be clear to anyone reading, because it's not really explained: * OP double-protects the SSH key. It means you need the key's passphrase and another factor (Google authenticator) to decrypt the ssh key. Then the ssh key is used to auth with the server. => the authentication with the server is still one factor auth, compromising the key at any level still gra…

The method listed in the article does authenticate with the SSH key first and then the second factor kicks in only if the key (and passphrase) are valid.

Doesn't ForceCommand do exactly the same thing except it allows you to do it globally?

Re: Simple Two-Factor SSH Authentication

#23

Post by moomerman » Fri, Sep 23, 2011, 2:52 PM UTC

ominous_prime wrote: post #19

munin wrote: post #13

if you exec the shell on your own (and make auth decisions on your own) outside of PAM you are basically destroying meaningful logging of successful/unsuccessful authentication, right?

You can log the events yourself. If it's a shell script, it would be as easy as: logger -p authpriv.notice "Some message about authentication"

That is great thank you, I was looking for something along those lines

Re: Simple Two-Factor SSH Authentication

#24

Post by Estragon » Fri, Sep 23, 2011, 2:56 PM UTC

vaneck wrote: post #4

Beware that this may break apps that use SSH as a transport protocol (like rsync and mercurial, depending on your setup of course).

You could set those up with separate identities authorized with forced commands, though I'm not sure how you would secure rsync from abuse.

Re: Simple Two-Factor SSH Authentication

#25

Post by pedrocr » Fri, Sep 23, 2011, 3:09 PM UTC

In the authorized_keys script, if instead of exec()ing SHELL you use SSH_ORIGINAL_COMMAND you won't break "ssh myhost "

Re: Simple Two-Factor SSH Authentication

#26

Post by pedrocr » Fri, Sep 23, 2011, 3:10 PM UTC

jaryd wrote: post #10

Could a user bypass this by using: ssh user@host.com -Tv 'bash' ?

The command you pass in is available to the command="" script in SSH_ORIGINAL_COMMAND, so you can exec() that or ignore it

Re: Simple Two-Factor SSH Authentication

#27

Post by moomerman » Fri, Sep 23, 2011, 3:11 PM UTC

pedrocr wrote: post #25

In the authorized_keys script, if instead of exec()ing SHELL you use SSH_ORIGINAL_COMMAND you won't break "ssh myhost "

In the extended example it does actually use the SSH_ORIGINAL_COMMAND, will update the simple version too

Re: Simple Two-Factor SSH Authentication

#28

Post by pedrocr » Fri, Sep 23, 2011, 3:12 PM UTC

moomerman wrote: post #5

vaneck wrote: post #4

Beware that this may break apps that use SSH as a transport protocol (like rsync and mercurial, depending on your setup of course).

The extended example 'should' work with those kinds of apps. The trivial example does not.

More specifically it checks for the SSH_ORIGINAL_COMMAND environment variable and executes it if it exists, thus making "ssh myhost " work again.

Re: Simple Two-Factor SSH Authentication

#29

Post by dendory » Fri, Sep 23, 2011, 3:12 PM UTC

A while back I wondered how hard it would be to integrate two-factor authentication on a web site using Google's Authenticator app, since it uses open protocols and is available on all platforms. Turns out it's incredibly easy. Even made a demo: http://dendory.net/twofactors/

Re: Simple Two-Factor SSH Authentication

#30

Post by pedrocr » Fri, Sep 23, 2011, 3:14 PM UTC

moomerman wrote: post #27

pedrocr wrote: post #25

In the authorized_keys script, if instead of exec()ing SHELL you use SSH_ORIGINAL_COMMAND you won't break "ssh myhost "

In the extended example it does actually use the SSH_ORIGINAL_COMMAND, will update the simple version too

In the extended example you're falling back to exec(SHELL) if SSH_ORIGINAL_COMMAND doesn't exist. Does sshd not set that to the login shell if no command is specified by the client?