Hardening SSH with 2FA • Hacker News Board

Re: Hardening SSH with 2FA

#51

Post by tialaramex » Sun, Apr 21, 2019, 1:26 AM UTC

tptacek wrote: post #28

idlewords wrote: post #12

Earlier quoted context omitted.

I actually had no idea SSH had support for one-time passwords, but I see docs for OTPW here: https://www.digitalocean.com/community/tutorials/install-and... This looks like exactly the answer I needed; thank you!

It sounds like you're trying to do something like Yubikey OTP or U2F with SSH. Both are doable, but I don't think that's the normal way people use hardware tokens with SSH; what I've seen much more is that people use Y4 keys (which are basically pocket HSMs), generate RSA keypairs with them, and configure SSH to accept the public key on the token. This doesn't require any support on the serverside; as far as the serv…

> something like Yubikey OTP or U2F with SSH. Both are doable

I would be interested in how you think U2F with SSH is doable. Maybe with a custom SSH server and client?

Have you actually see this done in anger?

Re: Hardening SSH with 2FA

#52

Post by middleclick » Sun, Apr 21, 2019, 1:29 AM UTC

fiatjaf wrote: post #46

2FA works great until you lose your phone.

It uses TOTP, not SMS.

Re: Hardening SSH with 2FA

#53

Post by pimlottc » Sun, Apr 21, 2019, 1:53 AM UTC

pmorici wrote: post #32

cmehdy wrote: post #17

Earlier quoted context omitted.

Some yubikeys provide smart-card functionality. https://www.yubico.com/solutions/smart-card/

They all do it is just a matter of how the end user configures them.

Not true; the cheaper blue "Security Key" model only supports FIDO and U2F.

https://www.yubico.com/store/#SKY https://www.yubico.com/product/security-key-by-yubico/

Re: Hardening SSH with 2FA

#54

Post by pimlottc » Sun, Apr 21, 2019, 1:55 AM UTC

noinsight wrote: post #24

jplayer01 wrote: post #15

Earlier quoted context omitted.

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

> Wait, really? They still make these? People still use them? Mandated by the US government so yes, lots of people use them. https://en.wikipedia.org/wiki/Common_Access_Card

CACs are just within the Department of Defense (+ Coast Guard). In the wider Federal government, they are called PIVs and use a slightly different standard:

https://en.wikipedia.org/wiki/FIPS_201

Re: Hardening SSH with 2FA

#55

Post by bithaze » Sun, Apr 21, 2019, 2:02 AM UTC

luminati wrote: post #49

disclaimer: not a security expert of any kind. Also apologies in advance for hijacking the thread. I loosely remember reading on HN that wireguard could be a replacement for ssh. Is that still the case? When do you think we'd be switching away from ssh to wire guard?

I don't know that I'd call it a replacement, strictly speaking. A different transport mechanism, maybe.

Re: Hardening SSH with 2FA

#56

Post by femto113 » Sun, Apr 21, 2019, 2:13 AM UTC

Development infrastructure like Jenkins has no business being on the internet, so my preferred "second factor" is a VPN, secured with machine specific certificates that offer only VPN connectivity, but not SSH or anything else. This means even if a developer's Git or SSH key is floating around your infrastructure no one without VPN access can get at it, and if a developer loses a laptop there's a good chance you'll hear about that in time to revoke that machine's VPN certificate before anyone has a chance to use it.

Re: Hardening SSH with 2FA

#57

Post by StavrosK » Sun, Apr 21, 2019, 2:41 AM UTC

pimlottc wrote: post #53

pmorici wrote: post #32

Earlier quoted context omitted.

They all do it is just a matter of how the end user configures them.

Not true; the cheaper blue "Security Key" model only supports FIDO and U2F. https://www.yubico.com/store/#SKY https://www.yubico.com/product/security-key-by-yubico/

Those aren't Yubikeys, though. They're Yubico security keys.

Re: Hardening SSH with 2FA

#58

Post by monocasa » Sun, Apr 21, 2019, 2:52 AM UTC

Just going to throw out there that the company I work at (JumpCloud) is a directory service that makes it super easy to setup 2FA with your SSH. Literally a couple checkboxes, and you can mandate that your whole staff has 2FA setup.

Re: Hardening SSH with 2FA

#59

Post by donatj » Sun, Apr 21, 2019, 2:58 AM UTC

How does this compare to just putting a passphrase on your ssh credentials?

Re: Hardening SSH with 2FA

#60

Post by _ytji » Sun, Apr 21, 2019, 3:01 AM UTC

kiallmacinnes wrote: post #48

_ytji wrote: post #11

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…

If all you care about is your SSH key not being stolen, then you can very easily use a YubiKey (or other smartcard..) with SSH via either GPG or PKCS11. Both will mean your key never leaves your YubiKey (or other smartcard...). This doesn't prevent your colleagues from having their key stolen, but does protect yours. I can use the YubiKey for SSH from Linux, Mac, Android phones without issue, and I keep several YubiK…

I'm less worried about losing a hardware key than I am about something breaking in a mysterious way and locking me out! My initially question was really about personal (unshared) systems. (I don't know - a random auto-update busting a non-standard PAM module and preventing it from loading, or even something just changing the PAM configs on its own, doesn't seem impossible to me). I'd definitely keep a spare if i went the Yubi route.