{"id":6545,"date":"2014-03-18T17:59:30","date_gmt":"2014-03-18T17:59:30","guid":{"rendered":"https:\/\/noi3.org\/site\/?p=6545"},"modified":"2014-03-18T17:59:30","modified_gmt":"2014-03-18T17:59:30","slug":"how-to-secure-ssh-with-google-authenticator-s-two-factor-authentication","status":"publish","type":"post","link":"https:\/\/site.noi3.org\/?p=6545","title":{"rendered":"How to Secure SSH with Google Authenticator\u2019s Two-Factor Authentication"},"content":{"rendered":"

\t\"google-authenticator-ssh-header\"<\/p>\n

\tWant to secure your SSH server with easy-to-use two-factor authentication? Google provides the necessary software to integrate Google Authenticator\u2019s time-based one-time password (TOTP) system with your SSH server. You\u2019ll have to enter the code from your phone when you connect.<\/p>\n

<\/p>\n

\t\"google-authenticator-ssh-header\"<\/p>\n

\tWant to secure your SSH server with easy-to-use two-factor authentication? Google provides the necessary software to integrate Google Authenticator\u2019s time-based one-time password (TOTP) system with your SSH server. You\u2019ll have to enter the code from your phone when you connect.<\/p>\n

\tGoogle Authenticator doesn\u2019t \u201cphone home\u201d to Google \u2014 all the work happens on your SSH server and your phone. In fact, Google Authenticator is completely open-source<\/a>, so you can even examine its source code yourself.<\/p>\n

\tInstall Google Authenticator<\/h3>\n

\tTo implement multifactor authentication with Google Authenticator, we\u2019ll need the open-source Google Authenticator PAM module. PAM stands for \u201cpluggable authentication module\u201d \u2013 it\u2019s a way to easily plug different forms of authentication into a Linux system.<\/p>\n

\tUbuntu\u2019s software repositories contain an easy-to-install package for the Google Authenticator PAM module. If your Linux distribution doesn\u2019t contain a package for this, you\u2019ll have to download it from the Google Authenticator downloads page<\/a> on Google Code and compile it yourself.<\/p>\n

\tTo install the package on Ubuntu, run the following command:<\/p>\n

\n

\t\tsudo apt-get install libpam-google-authenticator<\/p>\n<\/blockquote>\n

\t(This will only install the PAM module on our system \u2013 we\u2019ll have to activate it for SSH logins manually.)<\/p>\n

\t\"\"<\/p>\n

\tCreate an Authentication Key<\/h3>\n

\tLog in as the user you\u2019ll be logging in with remotely and run the google-authenticator <\/strong>command to create a secret key for that user.<\/p>\n

\tAllow the command to update your Google Authenticator file by typing y. You\u2019ll then be prompted with several questions that will allow you to restrict uses of the same temporary security token, increase the time window that tokens can be used for, and limit allowed acces attempts to hinder brute-force cracking attempts. These choices all trade some security for some ease-of-use.<\/p>\n

\t\"\"<\/p>\n

\tGoogle Authenticator will present you with a secret key and several \u201cemergency scratch codes.\u201d Write down the emergency scratch codes somewhere safe \u2013 they can only be used one time each, and they\u2019re intended for use if you lose your phone.<\/p>\n

\t\"\"<\/p>\n

\tEnter the secret key in the Google Authenticator app on your phone (official apps are available for Android, iOS, and Blackberry<\/a>). You can also use the scan barcode feature \u2013 go to the URL located near the top of the command\u2019s output and you can scan a QR code with your phone\u2019s camera.<\/p>\n

\t\"\"<\/p>\n

\tYou\u2019ll now have a constantly changing verification code on your phone.<\/p>\n

\t\"\"<\/p>\n

\tIf you want to log in remotely as multiple users, run this command for each user. Each user will have their own secret key and their own codes.<\/p>\n

\tActivate Google Authenticator<\/h3>\n

\tNext you\u2019ll have to require Google Authenticator for SSH logins. To do so, open the \/etc\/pam.d\/sshd <\/strong>file on your system (for example, with the sudo nano \/etc\/pam.d\/sshd<\/strong> command) and add the following line to the file:<\/p>\n

\n

\t\tauth required pam_google_authenticator.so<\/p>\n<\/blockquote>\n

\tNext, open the \/etc\/ssh\/sshd_config<\/strong> file, locate the ChallengeResponseAuthentication<\/strong> line, and change it to read as follows:<\/p>\n

\n

\t\tChallengeResponseAuthentication yes<\/p>\n<\/blockquote>\n

\t(If the ChallengeResponseAuthentication<\/strong> line doesn\u2019t already exist, add the above line to the file.)<\/p>\n

\tFinally, restart the SSH server so your changes will take effect:<\/p>\n

\n

\t\tsudo service ssh restart<\/p>\n<\/blockquote>\n

\t\"\"<\/p>\n

\tYou\u2019ll be prompted for both your password and Google Authenticator code whenever you attempt to log in via SSH.<\/p>\n

\t\"\"<\/p>\n

\n
\n

\t\tArticolul original<\/a><\/p>\n

\n

\t\t\u00a0<\/p>\n<\/p><\/div>\n

\t\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

Want to secure your SSH server with easy-to-use two-factor authentication? Google provides the necessary software to integrate Google Authenticator\u2019s time-based one-time password (TOTP) system with…<\/p>\n","protected":false},"author":2,"featured_media":6537,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[1311,457,1310,248],"class_list":["post-6545","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-informatica","tag-cod","tag-google","tag-ssh","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/site.noi3.org\/index.php?rest_route=\/wp\/v2\/posts\/6545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/site.noi3.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/site.noi3.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/site.noi3.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/site.noi3.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6545"}],"version-history":[{"count":0,"href":"https:\/\/site.noi3.org\/index.php?rest_route=\/wp\/v2\/posts\/6545\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/site.noi3.org\/index.php?rest_route=\/wp\/v2\/media\/6537"}],"wp:attachment":[{"href":"https:\/\/site.noi3.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/site.noi3.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/site.noi3.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}