Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using two-factor authentication for SSH

arm-blog.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Using two-factor authentication for SSH

#31

Post by peterwwillis »

georgyo wrote: post #11

The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers. A simpler and more robust method is SSH Keys + Passwords. I shou…

Here you go: RADIUS-enabled AD authentication of a VPN w/Google Authenticator 2nd factor. https://github.com/rharmonson/richtech/wiki/CentOS-7-Minimal...

You can also set up an SSH CA to validate clients by signed certificates, making managing a farm and its users' keys much easier. Then you don't even need an auth server online.

Re: Using two-factor authentication for SSH

#32

Post by aiiane »

georgyo wrote: post #11

The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers. A simpler and more robust method is SSH Keys + Passwords. I shou…

This is why U2F is a superior alternative to pin-based 2FA and hopefully will eventually replace it - you can use a single U2F device as a second factor for many different servers without either sharing keys or requiring a bunch of different authenticator entries.

Re: Using two-factor authentication for SSH

#33

Post by beagle3 »

nickik wrote: post #6
Freak_NL wrote: post #2

If you have public-facing SSH daemons running, adding 2FA seems sensible. Google Authenticator essentially turns another computing device (the smartphone) into an ersatz hardware token. While this does increase security, I don't like the trend of turning the smartphone into a universal second factor. Alternatively, you could go for a dedicated hardware token such as Yubico's FIDO U2F [1] keys [2]. Hardware tokens tha…

You can use Yubico OTP as you 2 Factor for SSH. As far as I know you can not use U2F as a 2 Factor over SSH because it needs support from OpenSSH (or whatever). A patch does exist, however, it is not yet upstream (any information on this welcome). However in the absence of U2F, you can still use Yubico OTP (HOTP) or you can use your yubikey together with your smartphone for TOTP. I think its a bad idea to use your sm…

How does the yubikey hard drive encryption work?

Re: Using two-factor authentication for SSH

#34

Post by Esau »

georgyo wrote: post #11

The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers. A simpler and more robust method is SSH Keys + Passwords. I shou…

I didn't realize that you could make SSH use both keys and passwords. I like the idea of that; even if it isn't as robust as 2FA. Please write it up.

Re: Using two-factor authentication for SSH

#35

Post by Freak_NL »

superuser2 wrote: post #28
Freak_NL wrote: post #24

Earlier quoted context omitted.

I don't own a smartphone, for one, but I could purchase one if it would benefit me. As it is though, I cannot justify the cost and the increased monthly expenses. But for the sake of argument; if I did own a smartphone, I wouldn't want to turn it into a sort of virtual keychain. I can buy three U2F keys for under €60, and have spares. Smartphones are a single point of failure — unless you are in the habit of collecti…

Hardware tokens are general purpose computers that have been locked down to the vendor's walled gardens. Yubikey is a JavaCard (in USB stick form factor) running some closed-source applets. There is a key that would allow you to load your own applets onto it but Yubico won't tell you what it is. From a software freedom perspective, hardware tokens/smart cards are no better than smartphones.

There is a crucial difference here. With FIDO U2F I am not limited to Yubico's offerings; there are other vendors. FIDO U2F devices can be manufactured by any company (and are).

I agree that the ideal situation would be a device that is completely under the control of the user, but compared to IOS or Android, a hardware token that only does what it is supposed to do (in the case of the U2F tokens; register and sign authentication requests), and cannot be modified by the manufacturer after sale is very much preferable.

Re: Using two-factor authentication for SSH

#37

Post by lrvick »

There is already a standard solution for this imo. Get a GPG smartcard like a Yubikey and put an Authentication subkey on it.

Now to ssh to anything, clone from Github, etc you insert your Yubikey, and enter your pin to unlock it. A gpg-agent process is created that acts as a standard ssh agent.

No server modifications required and you get strong hardware backed 2FA. The ssh private key never enters system memory and could not be stolen even by an untrusted machine.

If the smartcard itself is stolen, it will brick itself on 3 incorrect pin attempts.

The same device can also store all your OTP tokens or behave as U2F depending on what a service supports so the end game is secrets no longer live on disk or in memory on your systems.

This also integrates well on Android devices via the Yubikey Neo with apps like Yubico Authenticator and Open Keychain,

Re: Using two-factor authentication for SSH

#38

Post by yeukhon »

CaptSpify wrote: post #30
yeukhon wrote: post #29

Earlier quoted context omitted.

> A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this... Problem 1. Now you have to maintain password Problem 2. Now you have to handle prompt. Some Cfg tools are capable but is quite painful for others, which means you can't automate 2nd auth. Actually you can automate like 2nd auth there are paid service out there offer API. IMO, actually, better approach: * each instance on…

> Problem 2. Now you have to handle prompt. Some Cfg tools are capable but is quite painful for others, which means you can't automate 2nd auth. Actually you can automate like 2nd auth there are paid service out there offer API. You can use ssh-agents for this. Some people consider that cheating though |;)

Sorry maybe I am not aligned, ssh-agent for handling password prompt? ssh-agent afaik is useful for going from A->B and then B carrying that over to C,D,E,F,G etc

Re: Using two-factor authentication for SSH

#40

Post by lrvick »

newman314 wrote: post #39

Using 2FA is all well and good but what I haven't found is a good solution for managing ssh keys for an organization/group. Would love to get some recommendations here.

I tend to store authorized ssh public keys in a database then configure all servers with the appropriate AuthorizedKeysCommand in sshd_config to fetch them on the fly.

I also tend to include some form of caching in case the connection to the database is broken.

With this I can maintain keys for an entire cluster centrally.

This is all in place with open source configuration and tooling on https://hashbang.sh (https://github.com/hashbang). It is implemented with LDAP+sssd there. Feel free to pop in as we love discussing this stuff.

We have done similar with etcd as the backing database at my employer.

Post reply on HN