41–47 of 47 posts
Earlier quoted context omitted.
What needs to go into trusted_keys?
Yeah, it is 12. Here is a basic usage guide: # groupadd yubikey # usermod -G yubikey USERNAME # echo "yubikeyid" >> /home/USERNAME/.ssh/trusted_yubikeys # (yubikeyid is first 12 characters of the OTP) # chmod 755 /usr/local/bin/yubikey.sh # (this file is /usr/local/bin/yubikey.sh) # echo "Match group yubikey" >> /etc/ssh/sshd_config # echo " ForceCommand /usr/local/bin/yubikey.sh" >> /etc/ssh/sshd_config # (that's a…
Earlier quoted context omitted.
What needs to go into trusted_keys?
Yeah, it is 12. Here is a basic usage guide: # groupadd yubikey # usermod -G yubikey USERNAME # echo "yubikeyid" >> /home/USERNAME/.ssh/trusted_yubikeys # (yubikeyid is first 12 characters of the OTP) # chmod 755 /usr/local/bin/yubikey.sh # (this file is /usr/local/bin/yubikey.sh) # echo "Match group yubikey" >> /etc/ssh/sshd_config # echo " ForceCommand /usr/local/bin/yubikey.sh" >> /etc/ssh/sshd_config # (that's a…
Earlier quoted context omitted.
Yeah, it is 12. Here is a basic usage guide: # groupadd yubikey # usermod -G yubikey USERNAME # echo "yubikeyid" >> /home/USERNAME/.ssh/trusted_yubikeys # (yubikeyid is first 12 characters of the OTP) # chmod 755 /usr/local/bin/yubikey.sh # (this file is /usr/local/bin/yubikey.sh) # echo "Match group yubikey" >> /etc/ssh/sshd_config # echo " ForceCommand /usr/local/bin/yubikey.sh" >> /etc/ssh/sshd_config # (that's a…
If you're still on CentOS 5.7 you might need to upgrade your openssh package. Might I recommend openssh-5.8.p1 with the HPN patch ( http://www.psc.edu/networking/projects/hpn-ssh/#patches )
Earlier quoted context omitted.
These are much more sensible that the OP's solution. Just to be clear to anyone reading, because it's not really explained: * OP double-protects the SSH key. It means you need the key's passphrase and another factor (Google authenticator) to decrypt the ssh key. Then the ssh key is used to auth with the server. => the authentication with the server is still one factor auth, compromising the key at any level still gra…
The method listed in the article does authenticate with the SSH key first and then the second factor kicks in only if the key (and passphrase) are valid. Doesn't ForceCommand do exactly the same thing except it allows you to do it globally?
I guess I found a serious security problem.
When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.
What a great solution. I will use it, but... I guess I found a serious security problem. When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.
debug1: Remote: Forced command.
What a great solution. I will use it, but... I guess I found a serious security problem. When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.
I don't see the secret in the output when I run that command. It just says: debug1: Remote: Forced command.