Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening SSH with 2FA

gist.github.com

Post reply on HN
Print view View original

61–70 of 103 posts

Re: Hardening SSH with 2FA

#61

Post by idlewords »

tptacek wrote: post #13
idlewords wrote: post #2

I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…

Easy: on each host you log into, you enter into authorized_keys your Yubikey RSA pubkey and a standard software SSH pubkey. The private key for the software keypair, you stick on a thumb drive and keep in a drawer or a safe or whatever. Later Sorry, I see below you're thinking about using Yubikeys in addition to keypairs. This obviously doesn't answer that question.

No, your original answer was what I needed! I'm fine using just keypairs where the private half has never left a yubikey.

Re: Hardening SSH with 2FA

#62

Post by kerng »

femto113 wrote: post #56

Development infrastructure like Jenkins has no business being on the internet, so my preferred "second factor" is a VPN, secured with machine specific certificates that offer only VPN connectivity, but not SSH or anything else. This means even if a developer's Git or SSH key is floating around your infrastructure no one without VPN access can get at it, and if a developer loses a laptop there's a good chance you'll h…

That approach is a good defense in depth technique.

Network security by itself doesn't work but entirely neglecting it as some misguided articles I read recently makes me wonder if security is actually moving backwards when it comes to fundamentals and principles.

Granted those supporters are frequently cloud vendors, that dont offer mature enterprise integration. But when smaller shops follow those as best practices I'm getting worried.

Re: Hardening SSH with 2FA

#64

Post by pimlottc »

StavrosK wrote: post #57
pimlottc wrote: post #53

Earlier quoted context omitted.

Not true; the cheaper blue "Security Key" model only supports FIDO and U2F. https://www.yubico.com/store/#SKY https://www.yubico.com/product/security-key-by-yubico/

Those aren't Yubikeys, though. They're Yubico security keys.

Huh, I guess you are technically correct. They are listed on the Yubikey product page, though, and Yubikey is so strongly associated with Yubico that the distinction is easily lost.

Re: Hardening SSH with 2FA

#65

Post by microtonal »

xorcist wrote: post #29
_ytji wrote: post #11

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…

Megacorps have their own reasons to select technology. Your best bet is probably to go with a Yubikey (or something like it). It's about $50 and it's what several of the big Linux projects themselves use so it's well tested and documented.

Or one of the Nitrokeys, which are generally more affordable and have open source firmware:

https://www.nitrokey.com

Re: Hardening SSH with 2FA

#66

Post by jlgaddis »

alias_neo wrote: post #26
_ytji wrote: post #11

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…

I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.

> I'm afraid to link it here because the traffic might kill my puny box.

So what if it does?

Presumably it isn't a "critical" host so the worst that could happen is, what, no one can read what your blog posts for a little while? Eventually, the traffic will go away and things will go back to normal, yeah?

I assume that (part of) the reason for writing your blog post was so that others could read it. Yet, by not posting the link, you are ensuring that we don't -- even though pretty much all of us in this comment thread are the target audience.

Alternatively, as someone else mentioned, there are things like the Internet Archive.

(FWIW, several years ago, a page on my blog was linked by The Atlantic one morning and shortly thereafter it also hit the front page of (IIRC) both Reddit and HN. The only way I figured out that "something was up" was due to the huge number of "new follower" notifications I was getting from Twitter as I was driving to work. At the time, I was running WordPress on a little VPS with 1 CPU core and 768 MB of RAM and it handled the ~115,000 page views just fine that day -- although I did have caching and such in place. YMMV.)

Re: Hardening SSH with 2FA

#67

Post by perlgeek »

pm90 wrote: post #20
perlgeek wrote: post #5

Earlier quoted context omitted.

> I'm also not sure of the rationale for having a bastion host It's a central place where you can do your logging, which many enterprises must do for compliance reasons.

Really? Do any compliance standards specifically require this? Or is the specific control defined in the organization itself that requires this? I've found many compliance standards to be pretty open-ended and function-driven, rather than prescribing specific standards. Client contracts.... they may be a different beast, and often require specific promises by vendors.

I'm pretty sure that at least some of the German financial regulations require that you can audit administrative actions on systems that are relevant for the financial transactions.

Now, you could try to implement that on the systems themselves, but how do you establish a mechanism that logs actions of an administrative user, and at the same time cannot be disabled by the same administrative user?

So instead you use a shell control box as a bastion, and regular administration of the target hosts don't have root access to the shell control box, so they cannot circumvent logging.

I haven't yet any standards that explicitly demand bastions, but it seems to be one of the standard implementations that have proven to pass audits, and so it's a pretty low-risk implementation of the logging requirements.

Re: Hardening SSH with 2FA

#68

Post by rincebrain »

microtonal wrote: post #65
xorcist wrote: post #29

Earlier quoted context omitted.

Megacorps have their own reasons to select technology. Your best bet is probably to go with a Yubikey (or something like it). It's about $50 and it's what several of the big Linux projects themselves use so it's well tested and documented.

Or one of the Nitrokeys, which are generally more affordable and have open source firmware: https://www.nitrokey.com

Do they offer a good solution to the dual problem of:

- if you can flash/read everything, so can an attacker

- if you have a blackbox nothing can peer into, how can you trust the device?

Re: Hardening SSH with 2FA

#69

Post by Fnoord »

luminati wrote: post #49

disclaimer: not a security expert of any kind. Also apologies in advance for hijacking the thread. I loosely remember reading on HN that wireguard could be a replacement for ssh. Is that still the case? When do you think we'd be switching away from ssh to wire guard?

SSH is a service to log in securely to get CLI access. WireGuard is an efficient VPN with low attack surface. SSH can be used to run X programs, as proxy, or VPN.

Re: Hardening SSH with 2FA

#70

Post by alias_neo »

jlgaddis wrote: post #66
alias_neo wrote: post #26

Earlier quoted context omitted.

I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.

> I'm afraid to link it here because the traffic might kill my puny box. So what if it does? Presumably it isn't a "critical" host so the worst that could happen is, what, no one can read what your blog posts for a little while? Eventually, the traffic will go away and things will go back to normal, yeah? I assume that (part of) the reason for writing your blog post was so that others could read it. Yet, by not posti…

You make many valid points there.

Here's the link, let's see what happens:

Caveat lector: This is a "beginner" guide targeted at Raspberry Pi users, ignore the Pi related parts.

I intend to publish a second part about using keys instead of passwords.

https://2byt.es/post/totp/

The blog content is open source on GitHub so feel free to raise issues if necessary.

Post reply on HN