You can get 2FA over ssh by requiring both key based and password based authentication. That is, you need both your private key and your account password to log in (in addition to your private key passphrase).
Hardening SSH with 2FA
31–40 of 103 posts
Re: Hardening SSH with 2FA
#32Earlier quoted context omitted.
Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?
Some yubikeys provide smart-card functionality. https://www.yubico.com/solutions/smart-card/
They all do it is just a matter of how the end user configures them.
Re: Hardening SSH with 2FA
#33Earlier quoted context omitted.
Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?
> Wait, really? They still make these? People still use them? Mandated by the US government so yes, lots of people use them. https://en.wikipedia.org/wiki/Common_Access_Card
Yeah, and that's just the DoD, even the US Forest Service mandates the use of a smartcard to log in to their VPN.
Re: Hardening SSH with 2FA
#34Once just for fun I setup HAProxy in TCP mode and depending on the host name would direct the SSH to the correct host. But I had some nice ACLs so that if they weren’t in the ACL they would be sent to a honeypot.
How did HAProxy know the host name?
Re: Hardening SSH with 2FA
#35Re: Hardening SSH with 2FA
#36This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki
What do actual card-form-factor “smartcards” get me over using the CCID interface on the Yubikey?
Re: Hardening SSH with 2FA
#37How does this compare to Teleport:
Re: Hardening SSH with 2FA
#38I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…
I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.
> I'm afraid to link it here because the traffic might kill my puny box.
Setup Cloudflare, which is free and easy to use. Or, just post an Internet Archive wayback machine copy of your post would be good enough.
Re: Hardening SSH with 2FA
#39This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki
What do actual card-form-factor “smartcards” get me over using the CCID interface on the Yubikey?
Not much as far as SSH is concerned, but you can buy many smart cards and just use one cardreader. For personal use it's more convenient to use Yubikey as a commercial proprietary solution.
Re: Hardening SSH with 2FA
#40I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…
I had to do a pam config recently. Having only tweaked a few settings previously, it was kind of intimidating as I was doing some security-type stuff and had to rewrite the config. I locked myself out more times than I care to remember; thank God I was working (mostly) in virtual machines. This is especially a problem since the necessary pam settings vary from distro to distro.
If you really want to, test it on a vm that replicates your machine first and make sure you document exactly what to do to get it working. To be clear, it should be fine if you're just adding a module, but sometimes getting the exact settings can be hard, so make sure to do it in a vm first and be careful. Just trying to keep others from going through what I went through.