Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening SSH with 2FA

gist.github.com

Post reply on HN
Print view View original

71–80 of 103 posts

Re: Hardening SSH with 2FA

#71

Post by raghava »

femto113 wrote: post #56

Development infrastructure like Jenkins has no business being on the internet, so my preferred "second factor" is a VPN, secured with machine specific certificates that offer only VPN connectivity, but not SSH or anything else. This means even if a developer's Git or SSH key is floating around your infrastructure no one without VPN access can get at it, and if a developer loses a laptop there's a good chance you'll h…

Exactly. This is what I employ as one of the safeguards as well. All important resources accessible only to via a jumpbox, and jumbox itself is only accessible in a VPN.

Re: Hardening SSH with 2FA

#72

Post by alias_neo »

mises wrote: post #42
alias_neo wrote: post #26

Earlier quoted context omitted.

I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.

Unless you're hitting a database for every connection, even a puny box ought to be fine.

Static site, no DBs. Link's posted so let's see!

Re: Hardening SSH with 2FA

#73

Post by rollthehard6 »

_ytji wrote: post #11

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…

I'd never done anything much with pam before but found it relatively easy to get PrivacyIDEA working on CentOS, it's even easier if you're using Ubuntu. https://www.privacyidea.org/ and Cornelius is really helpful.

Re: Hardening SSH with 2FA

#74

Post by icebraining »

jplayer01 wrote: post #15
xaduha wrote: post #14

This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

In some countries, every national ID card is a smartcard, so millions of people use them. You can authenticate against our IRS site with yours, for example.

Re: Hardening SSH with 2FA

#76

Post by metafunctor »

_ytji wrote: post #60
kiallmacinnes wrote: post #48

Earlier quoted context omitted.

If all you care about is your SSH key not being stolen, then you can very easily use a YubiKey (or other smartcard..) with SSH via either GPG or PKCS11. Both will mean your key never leaves your YubiKey (or other smartcard...). This doesn't prevent your colleagues from having their key stolen, but does protect yours. I can use the YubiKey for SSH from Linux, Mac, Android phones without issue, and I keep several YubiK…

I'm less worried about losing a hardware key than I am about something breaking in a mysterious way and locking me out! My initially question was really about personal (unshared) systems. (I don't know - a random auto-update busting a non-standard PAM module and preventing it from loading, or even something just changing the PAM configs on its own, doesn't seem impossible to me). I'd definitely keep a spare if i went…

It's pretty hard to permanently get locked out. In a pinch, you can always mount the disk in another machine, fix whatever is wrong, and boot the original machine back up.

Re: Hardening SSH with 2FA

#78

Post by floatboth »

akerl_ wrote: post #44
xaduha wrote: post #39

Earlier quoted context omitted.

Not much as far as SSH is concerned, but you can buy many smart cards and just use one cardreader. For personal use it's more convenient to use Yubikey as a commercial proprietary solution.

I guess it depends. If I’ve got a fleet of users with commodity laptops, and I want them to do CCID auth, I could buy them each a card reader and a card, or I could buy them each a yubikey and use their USB port. Things are different if this is the DoD or somewhere that’s already got card readers as a core component, but if this is the DoD, I’m already winning because I get to use their PKI/cards and don’t have to bu…

Proper ThinkPads (e.g. A285, X390, A485, T490) come with a card reader option for regular consumers

Re: Hardening SSH with 2FA

#79

Post by crtasm »

metafunctor wrote: post #76
_ytji wrote: post #60

Earlier quoted context omitted.

I'm less worried about losing a hardware key than I am about something breaking in a mysterious way and locking me out! My initially question was really about personal (unshared) systems. (I don't know - a random auto-update busting a non-standard PAM module and preventing it from loading, or even something just changing the PAM configs on its own, doesn't seem impossible to me). I'd definitely keep a spare if i went…

It's pretty hard to permanently get locked out. In a pinch, you can always mount the disk in another machine, fix whatever is wrong, and boot the original machine back up.

Or if you rent a server from a provider they usually offer a rescue mode boot option.

Re: Hardening SSH with 2FA

#80

Post by therealmarv »

There are scenarios where 2FA makes no sense for me. These are local password managers and SSH keys.

Rethink this again: If your ssh key is compromised then you have a problem overall. For my point of view there is no real security gain in 2FA ssh key logins because your private key itself is already a secret! Only thing which is important is to set a good passphrase for your ssh key.

However I can think of one exception of 2FA on top of ssh keys which might be useful: 2FA for gaining root access or sudo commands. This might be okay but the attack vector in this scenario would be that someone can see your keystrokes or clipboard (then they most likely also have your ssh private key if they can do that).

Post reply on HN