Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Simple Two-Factor SSH Authentication

moocode.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: Simple Two-Factor SSH Authentication

#31

Post by moomerman »

moomerman wrote: post #27
pedrocr wrote: post #25

In the authorized_keys script, if instead of exec()ing SHELL you use SSH_ORIGINAL_COMMAND you won't break "ssh myhost "

In the extended example it does actually use the SSH_ORIGINAL_COMMAND, will update the simple version too

SSH_ORIGINAL_COMMAND isn't in the ENV at all if no command was passed through

Re: Simple Two-Factor SSH Authentication

#32

Post by pedrocr »

I was using the command="" stuff to restrict a user to only running rsync the other day and was considering writing the script in ruby as was done here. Does anyone have any opinion on how safe that is? The client shouldn't have that many ways to interact with the ruby process but I was still wondering if I should stick to something smaller like /bin/sh (not even bash) for safety.

Re: Simple Two-Factor SSH Authentication

#33

Post by pedrocr »

moomerman wrote: post #31
moomerman wrote: post #27

Earlier quoted context omitted.

In the extended example it does actually use the SSH_ORIGINAL_COMMAND, will update the simple version too

SSH_ORIGINAL_COMMAND isn't in the ENV at all if no command was passed through

Right, that was what I asked in my other post. I assumed sshd would fill in the login shell there if nothing was passed as that is effectively what is being called but it seems not. I see you're doing exec(SHELL) to fix that.

Re: Simple Two-Factor SSH Authentication

#34

Post by jaryd »

corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

Thanks for the post! I just modded this to work with twilio -- sweet!

Additionally, if you don't want to pay for SMS you could send an email to your cell number.

Re: Simple Two-Factor SSH Authentication

#35

Post by mdp »

zobzu wrote: post #20
corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

These are much more sensible that the OP's solution. Just to be clear to anyone reading, because it's not really explained: * OP double-protects the SSH key. It means you need the key's passphrase and another factor (Google authenticator) to decrypt the ssh key. Then the ssh key is used to auth with the server. => the authentication with the server is still one factor auth, compromising the key at any level still gra…

"* OP double-protects the SSH key. It means you need the key's passphrase and another factor (Google authenticator) to decrypt the ssh key. Then the ssh key is used to auth with the server. => the authentication with the server is still one factor auth, compromising the key at any level still grants access."

This is not correct. You can't decrypt a key with a one time password.

The OP is requiring a the second factor(the OTP) after the key is sent to the server and authenticated.

Re: Simple Two-Factor SSH Authentication

#36

Post by mentat »

corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

What needs to go into trusted_keys?

Re: Simple Two-Factor SSH Authentication

#39

Post by corin_ »

mentat wrote: post #36
corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

What needs to go into trusted_keys?

~/.ssh/trusted_yubikeys ?

It's the I'd of your specific Yubikey - I'm on my phone on a train right now, but off the top of my head it is the first 12 characters that get printed when you use your Yubikey. Pretty sure it's 12, anyway.

Re: Simple Two-Factor SSH Authentication

#40

Post by corin_ »

mentat wrote: post #36
corin_ wrote: post #15

As noted alsewhere, ForceCommand is a nicer option, and can be done with something like this in sshd_config: Match group yubikey # ForceCommand /usr/local/bin/yubikey.sh ForceCommand /usr/local/bin/mobileverification.sh The commented out script is something I wrote to authenticate Yubikeys - see http://yubico.com/yubikey And the mobileverification.sh sends a randomly generated 4 digit pin code to the phone number tha…

What needs to go into trusted_keys?

Yeah, it is 12. Here is a basic usage guide:

  # groupadd yubikey
  # usermod -G yubikey USERNAME
  # echo "yubikeyid" >> /home/USERNAME/.ssh/trusted_yubikeys
  # (yubikeyid is first 12 characters of the OTP)
  # chmod 755 /usr/local/bin/yubikey.sh
  # (this file is /usr/local/bin/yubikey.sh)
  # echo "Match group yubikey" >> /etc/ssh/sshd_config
  # echo "  ForceCommand /usr/local/bin/yubikey.sh" >> /etc/ssh/sshd_config
  # (that's a tab before ForceCommand)
  # /etc/init.d/ssh restart
Post reply on HN