Two Factor Authentication With OpenSSH - Revision history

Zcrayfish: The PAM configuration on this page does not work as described (it is single-factor). Redirected to a page with working instructions.

2023-07-29T15:48:54Z

The PAM configuration on this page does not work as described (it is single-factor). Redirected to a page with working instructions.

← Older revision		Revision as of 15:48, 29 July 2023
Line 1:		Line 1:
	~~== Configure OpenSSH to use PAM==~~		#REDIRECT[[HOWTO OpenSSH 2FA with password and Google Authenticator]]
	~~OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.~~

	~~{{cmd\|~~# ~~apk add google-authenticator openssh-server-pam}}~~

	~~First, configure the SSH daemon to use PAM authentication:~~
	~~{{cmd\|# cat /etc/ssh/sshd_config}}~~
	~~<pre>~~
	~~AuthenticationMethods publickey,keyboard-interactive~~
	~~ChallengeResponseAuthentication yes~~
	~~PermitRootLogin yes~~
	~~UsePAM yes~~
	~~</pre>~~
	~~{{Note\|This configuration does NOT allow password authentication globally}}~~

	~~Then, configure PAM by adding the following lines, enabling google-authenticator as the package handling authentication:~~

	* For Alpine 3.14 or newer:<br>
	~~{{cmd\|# cat /etc/pam.d/sshd.pam #create the file if needed}}~~
	* For Alpine 3.13 or older:
	~~{{cmd\|# cat /etc/pam.d/sshd #create the file if needed}}~~
	~~<pre>~~
	~~account include base-account~~

	~~auth required pam_env.so~~
	~~auth required pam_nologin.so successok~~
	~~auth include google-authenticator~~
	~~</pre>~~

	~~== Time-based One Time Password authentication (TOTP RFC 6238) ==~~
	~~As the root user:~~
	~~{{cmd\|# google-authenticator}}~~
	~~{{Note\|Please take note of <secret>}}~~
	~~<pre>~~
	~~Do you want authentication tokens to be time-based (y/n) y~~
	~~https://www.google.com/<pruned>~~
	~~Your new secret key is: <secret>~~
	~~Your verification code is <pruned>~~
	~~Your emergency scratch codes are:~~
	~~<pruned>~~
	~~<pruned>~~
	~~<pruned>~~
	~~<pruned>~~
	~~<pruned>~~

	~~Do you want me to update your "/root/.google_authenticator" file? (y/n) y~~

	~~Do you want to disallow multiple uses of the same authentication~~
	~~token? This restricts you to one login about every 30s, but it increases~~
	~~your chances to detect or prevent man-in-the-middle attacks (y/n) n~~

	~~By default, tokens are good for 30 seconds. In order to compensate for~~
	~~possible time-skew between the client and server, we allow an extra~~
	~~token before and after the current time. If you experience problems with~~
	~~poor time synchronization, you can increase the window from its default~~
	~~size of ±1min (window size of 3) to about ±4min (window size of~~
	~~17 acceptable tokens).~~
	~~Do you want to do so? (y/n) n~~

	~~If the computer that you are logging into isn't hardened against brute force~~
	~~login attempts, you can enable rate-limiting for the authentication module.~~
	~~By default, this limits attackers to no more than 3 login attempts every 30s.~~
	~~Do you want to enable rate-limiting (y/n) n~~
	~~</pre>~~

	~~{{Tip\|You might want to answer questions 2, 3 and 4 differently based on your paranoia level and firewall settings :)}}~~

	~~Re-run <code>google-authenticator</code> for each user that needs to login via SSH. Don't forget to include <code>.google_authenticator</code> files in your~~ [[~~Alpine_local_backup\|LBU]] if you're running from RAM.~~

	~~== Authentication token ==~~
	~~Download the '''Google Authenticator''' app from the ''App Store''. Startup '''Google Authenticator''' and manually enter your <secret> key.~~

	~~== Login ==~~
	~~{{cmd\|$ ssh -v root@yourbox}}~~
	~~The last lines should say:~~
	~~<pre>~~
	~~Authenticated~~ with ~~partial success.~~
	~~debug1: Authentications that can continue: keyboard-interactive~~
	~~debug1: Next authentication method: keyboard-interactive~~
	~~Verification code:~~
	~~</pre>~~
	~~<code>Authenticated with partial success</code> means that pubkey authentication was successful~~ and ~~now the verifier is asking for the verification code generated from the '''~~Google Authenticator~~''' app.~~

	~~[[Category:Authentication~~]]

Psykose: remove stale rename flag

2023-06-07T01:37:56Z

remove stale rename flag

← Older revision		Revision as of 01:37, 7 June 2023
Line 1:		Line 1:
	~~{{Move\|Two-Factor Authentication with OpenSSH\|Spelling/Grammar}}~~

	== Configure OpenSSH to use PAM==		== Configure OpenSSH to use PAM==
	OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.		OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.

Psykose: Psykose moved page Two Factors Authentication With OpenSSH to Two Factor Authentication With OpenSSH: spelling

2023-06-07T01:37:40Z

Psykose moved page Two Factors Authentication With OpenSSH to Two Factor Authentication With OpenSSH: spelling

← Older revision	Revision as of 01:37, 7 June 2023
(No difference)

Bbbhltz: Rename proposal

2023-04-21T11:28:56Z

Rename proposal

← Older revision		Revision as of 11:28, 21 April 2023
Line 1:		Line 1:
			{{Move\|Two-Factor Authentication with OpenSSH\|Spelling/Grammar}}

	== Configure OpenSSH to use PAM==		== Configure OpenSSH to use PAM==
	OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.		OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.

Bt129 at 20:23, 24 July 2021

2021-07-24T20:23:10Z

← Older revision		Revision as of 20:23, 24 July 2021
Line 14:		Line 14:
	{{Note\|This configuration does NOT allow password authentication globally}}		{{Note\|This configuration does NOT allow password authentication globally}}

	Then, configure ~~pam~~ by adding the following lines, enabling google-authenticator as the package handling authentication:		Then, configure PAM by adding the following lines, enabling google-authenticator as the package handling authentication:

	* For Alpine 3.14 or newer:<br>		* For Alpine 3.14 or newer:<br>
Line 29:		Line 29:

	== Time-based One Time Password authentication (TOTP RFC 6238) ==		== Time-based One Time Password authentication (TOTP RFC 6238) ==
	As user ~~root~~:		As the root user:
	{{cmd\|# google-authenticator}}		{{cmd\|# google-authenticator}}
	{{Note\|Please take note of <secret>}}		{{Note\|Please take note of <secret>}}
Line 48:		Line 48:
	Do you want to disallow multiple uses of the same authentication		Do you want to disallow multiple uses of the same authentication
	token? This restricts you to one login about every 30s, but it increases		token? This restricts you to one login about every 30s, but it increases
	your chances to ~~notice~~ or ~~even~~ prevent man-in-the-middle attacks (y/n) n		your chances to detect or prevent man-in-the-middle attacks (y/n) n

	By default, tokens are good for 30 seconds. In order to compensate for		By default, tokens are good for 30 seconds. In order to compensate for
	possible time-skew between the client and ~~the~~ server, we allow an extra		possible time-skew between the client and server, we allow an extra
	token before and after the current time. If you experience problems with		token before and after the current time. If you experience problems with
	poor time synchronization, you can increase the window from its default		poor time synchronization, you can increase the window from its default
	size of ~~+-1min~~ (window size of 3) to about ~~+-4min~~ (window size of		size of ±1min (window size of 3) to about ±4min (window size of
	17 acceptable tokens).		17 acceptable tokens).
	Do you want to do so? (y/n) n		Do you want to do so? (y/n) n

	If the computer that you are logging into isn't hardened against brute-force		If the computer that you are logging into isn't hardened against brute force
	login attempts, you can enable rate-limiting for the authentication module.		login attempts, you can enable rate-limiting for the authentication module.
	By default, this limits attackers to no more than 3 login attempts every 30s.		By default, this limits attackers to no more than 3 login attempts every 30s.
Line 64:		Line 64:
	</pre>		</pre>

	{{Tip\|You might want to answer ~~differently at~~ questions 2, 3 and 4 based on your paranoia's level and firewall settings :)}}		{{Tip\|You might want to answer questions 2, 3 and 4 differently based on your paranoia level and firewall settings :)}}

	Re-run <code>google-authenticator</code> for each user that needs to login via SSH. Don't forget to include <code>.google_authenticator</code> files in your [[Alpine_local_backup\|LBU]] if you're running from RAM.		Re-run <code>google-authenticator</code> for each user that needs to login via SSH. Don't forget to include <code>.google_authenticator</code> files in your [[Alpine_local_backup\|LBU]] if you're running from RAM.

	== Authentication token ==		== Authentication token ==
	Download '''Google Authenticator''' app from ~~your~~ ''App Store''. Startup '''Google Authenticator''' ~~app~~ and enter ~~manually~~ your <secret> key.		Download the '''Google Authenticator''' app from the ''App Store''. Startup '''Google Authenticator''' and manually enter your <secret> key.

	== Login ==		== Login ==
	{{cmd\|$ ssh -v root@yourbox}}		{{cmd\|$ ssh -v root@yourbox}}
	~~You should see the~~ last lines ~~saying~~:		The last lines should say:
	<pre>		<pre>
	Authenticated with partial success.		Authenticated with partial success.

Forst: Adjust PAM instructions for Alpine 3.14+

2021-07-02T22:49:39Z

Adjust PAM instructions for Alpine 3.14+

← Older revision		Revision as of 22:49, 2 July 2021
Line 1:		Line 1:
	== Configure ~~openSSH~~ to use PAM==		== Configure OpenSSH to use PAM==
	OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.		OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.

Line 15:		Line 15:

	Then, configure pam by adding the following lines, enabling google-authenticator as the package handling authentication:		Then, configure pam by adding the following lines, enabling google-authenticator as the package handling authentication:
	{{cmd\|# cat /etc/pam.d/sshd #create the file if needed}}
			* For Alpine 3.14 or newer:<br>
			{{cmd\|# cat /etc/pam.d/sshd.pam #create the file if needed}}
			* For Alpine 3.13 or older:
			{{cmd\|# cat /etc/pam.d/sshd #create the file if needed}}
	<pre>		<pre>
	account include base-account		account include base-account
Line 76:		Line 80:
	Verification code:		Verification code:
	</pre>		</pre>
	<code>Authenticated with partial success</code> means that pubkey authentication was ~~successfull~~ and now the verifier is asking for the verification code generated from the '''Google Authenticator''' app.		<code>Authenticated with partial success</code> means that pubkey authentication was successful and now the verifier is asking for the verification code generated from the '''Google Authenticator''' app.

	[[Category:Authentication]]		[[Category:Authentication]]

Astrawso at 17:26, 7 December 2018

2018-12-07T17:26:50Z

← Older revision		Revision as of 17:26, 7 December 2018
Line 64:		Line 64:
	Re-run <code>google-authenticator</code> for each user that needs to login via SSH. Don't forget to include <code>.google_authenticator</code> files in your [[Alpine_local_backup\|LBU]] if you're running from RAM.		Re-run <code>google-authenticator</code> for each user that needs to login via SSH. Don't forget to include <code>.google_authenticator</code> files in your [[Alpine_local_backup\|LBU]] if you're running from RAM.

	== ~~Prover~~ ==		== Authentication token ==
	Download '''Google Authenticator''' app from your ''App Store''. Startup '''Google Authenticator''' app and enter manually your <secret> key.		Download '''Google Authenticator''' app from your ''App Store''. Startup '''Google Authenticator''' app and enter manually your <secret> key.

Astrawso: /* Google Authenticator */

2018-12-07T17:21:22Z

Google Authenticator

← Older revision		Revision as of 17:21, 7 December 2018
Line 1:		Line 1:
	== ~~Google Authenticator~~ ==		== Configure openSSH to use PAM==
			OpenSSH allows us to configure PAM to handle authentication duties, working nicely with the {{pkg\|google-authenticator}} package.

	{{cmd\|# apk add google-authenticator openssh-server-pam}}		{{cmd\|# apk add google-authenticator openssh-server-pam}}

			First, configure the SSH daemon to use PAM authentication:
	{{cmd\|# cat /etc/ssh/sshd_config}}		{{cmd\|# cat /etc/ssh/sshd_config}}
	<pre>		<pre>
Line 13:		Line 14:
	{{Note\|This configuration does NOT allow password authentication globally}}		{{Note\|This configuration does NOT allow password authentication globally}}

			Then, configure pam by adding the following lines, enabling google-authenticator as the package handling authentication:
	{{cmd\|# cat /etc/pam.d/sshd #create the file if needed}}		{{cmd\|# cat /etc/pam.d/sshd #create the file if needed}}
	<pre>		<pre>

Astrawso at 17:13, 7 December 2018

2018-12-07T17:13:59Z

← Older revision		Revision as of 17:13, 7 December 2018
Line 1:		Line 1:
	== ~~Using~~ Google Authenticator ==		== Google Authenticator ==


	{{cmd\|# apk add google-authenticator openssh-server-pam}}		{{cmd\|# apk add google-authenticator openssh-server-pam}}

Astrawso: /* Login */

2018-12-07T17:05:32Z

← Older revision		Revision as of 17:05, 7 December 2018
Line 64:		Line 64:

	== Login ==		== Login ==
	{{cmd\|ssh -v root@yourbox}}		{{cmd\|$ ssh -v root@yourbox}}
	You should see the last lines saying:		You should see the last lines saying:
	<pre>		<pre>