6 ms·

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pa

by kylek 7y ago

I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself be in practice? (Am I being paranoid for NOT wanting to go the extra mile to ensure that I actually have access to my systems when I need it the most?)

tyingq 7y ago
The Google auth PAM module is very straightforward: https://github.com/google/google-authenticator-libpam https://github.com/google/google-authenticator-libpam You could run a separate instance of say, dropbear on another port as a failsafe, until you're comfortable. Or maybe firewall it off to a set of fixed source ips.
- kylek 7y ago
  Neat, this might be the lowest-friction approach I've seen so far. (My distro even has a `libpam-google-authenticator` package to boot)
JudgeWapner 7y ago
not a shill but I have great things to say about Yubikey. I'm a longtime linux enthusiast, but never a dojo master. Buying the yubikey and seeing the words "PAM module" made me expect a rodeo, but it was surprisingly easy. just from memory, but it was basically (on arch) 1) install the yubikey package, including a GUI utility to set up the Yubikey and PAM libraries (just .so files). 2) mess around with setting up the keys on the yubi. there are 2 slots that can be set up a variety of ways. 3) configure pam. it was basically one text file, and maybe copying a .so, way easier than I imagined. 4) set up ssh to only accept PAM authentication (delete 2-3 lines, add one line). 5) set up display manager to accept the yubikey OR password. so this way, my always-on router can ONLY be accessed by a yubikey. That uses "slot 1", which requires me to insert the yubi and long-touch it(it only has one button). and my desktop can be accessed without a password if the yubi is inserted (without pressing it or anything, this is slot0) or I can type my password if I want. what I thought was going to be a wild rodeo with bucking broncos and PAM module errors, turned out to be riding the coin-operated horse in front of the grocery store.
alias_neo 7y ago
I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.
- andyonthewings 7y ago
  > I'm afraid to link it here because the traffic might kill my puny box. Setup Cloudflare, which is free and easy to use. Or, just post an Internet Archive wayback machine copy of your post would be good enough.
  - askmike 7y ago
    Given that he: > I wrote a blog post on this recently, using only open-source tools that don't come from big corps. I doubt he wants to use CloudFlare ;)
    - Spivak 7y ago
      Philosophically is using CloudFlare or whatever CDN any worse that using the normal internet infrastructure in terms of software freedom?
      - askmike 7y ago
        Definitely, all traffic is readable by CloudFlare. Whereas if you have your own SSL certs everything going through the "normal internet infrastructure" is encrypted (in theory your webhost is able to get to it, but definitely not as easily - and this is only an issue if you rent a server). On top of that there are many arguments against CloudFlare when it comes to an open and decentralized internet. EDIT: didn't read the Philosophically in your comment. CloudFlare does many things against an open internet, for a long time they blocked (or required excessive captchas) for all TOR users.
- mises 7y ago
xorcist 7y ago
Megacorps have their own reasons to select technology. Your best bet is probably to go with a Yubikey (or something like it). It's about $50 and it's what several of the big Linux projects themselves use so it's well tested and documented.
- danieldk 7y ago
  Or one of the Nitrokeys, which are generally more affordable and have open source firmware: https://www.nitrokey.com https://www.nitrokey.com
  - rincebrain 7y ago
    Do they offer a good solution to the dual problem of: - if you can flash/read everything, so can an attacker - if you have a blackbox nothing can peer into, how can you trust the device?
    - oarsinsync 7y ago
      It looks like the very first FAQ answers that: 1) You generate your own root keys, to deploy onto the device, 2) You can't read the root keys back off the device once it's deployed.
      - rincebrain 7y ago
        That doesn't quite answer my question, I think. My statement was that: - if you have an opaque enclave on the device (e.g. a black box you can't peer into), you can't know what it's doing - if you don't, you can read the private key bits out Your statement was that it has a private enclave you cannot extract key material out of, which resolves the latter half of the question, but not the former, I think?
mises 7y ago
I had to do a pam config recently. Having only tweaked a few settings previously, it was kind of intimidating as I was doing some security-type stuff and had to rewrite the config. I locked myself out more times than I care to remember; thank God I was working (mostly) in virtual machines. This is especially a problem since the necessary pam settings vary from distro to distro. If you really want to, test it on a vm that replicates your machine first and make sure you document exactly what to do to get it working. To be clear, it should be fine if you're just adding a module, but sometimes getting the exact settings can be hard, so make sure to do it in a vm first and be careful. Just trying to keep others from going through what I went through.
kiallmacinnes 7y ago
If all you care about is your SSH key not being stolen, then you can very easily use a YubiKey (or other smartcard..) with SSH via either GPG or PKCS11. Both will mean your key never leaves your YubiKey (or other smartcard...). This doesn't prevent your colleagues from having their key stolen, but does protect yours. I can use the YubiKey for SSH from Linux, Mac, Android phones without issue, and I keep several YubiKeys with my keys on them so it's extremely unlikely I'll loose them all at once. Re the paranoia - if you're really the only person who can fix something, and you have lost your closest key, then - the thing in need of fixing can wait till you get home to your second key ;)
- kylek 7y ago
  I'm less worried about losing a hardware key than I am about something breaking in a mysterious way and locking me out! My initially question was really about personal (unshared) systems. (I don't know - a random auto-update busting a non-standard PAM module and preventing it from loading, or even something just changing the PAM configs on its own, doesn't seem impossible to me). I'd definitely keep a spare if i went the Yubi route.
  - metafunctor 7y ago
    It's pretty hard to permanently get locked out. In a pinch, you can always mount the disk in another machine, fix whatever is wrong, and boot the original machine back up.
    - crtasm 7y ago
      Or if you rent a server from a provider they usually offer a rescue mode boot option.
rollthehard6 7y ago
I'd never done anything much with pam before but found it relatively easy to get PrivacyIDEA working on CentOS, it's even easier if you're using Ubuntu. https://www.privacyidea.org/ https://www.privacyidea.org/ and Cornelius is really helpful.

by kylek 7y ago

tyingq 7y ago

The Google auth PAM module is very straightforward: https://github.com/google/google-authenticator-libpam https://github.com/google/google-authenticator-libpam You could run a separate instance of say, dropbear on another port as a failsafe, until you're comfortable. Or maybe firewall it off to a set of fixed source ips.

kylek 7y ago
Neat, this might be the lowest-friction approach I've seen so far. (My distro even has a `libpam-google-authenticator` package to boot)

JudgeWapner 7y ago

not a shill but I have great things to say about Yubikey. I'm a longtime linux enthusiast, but never a dojo master. Buying the yubikey and seeing the words "PAM module" made me expect a rodeo, but it was surprisingly easy. just from memory, but it was basically (on arch) 1) install the yubikey package, including a GUI utility to set up the Yubikey and PAM libraries (just .so files). 2) mess around with setting up the keys on the yubi. there are 2 slots that can be set up a variety of ways. 3) configure pam. it was basically one text file, and maybe copying a .so, way easier than I imagined. 4) set up ssh to only accept PAM authentication (delete 2-3 lines, add one line). 5) set up display manager to accept the yubikey OR password. so this way, my always-on router can ONLY be accessed by a yubikey. That uses "slot 1", which requires me to insert the yubi and long-touch it(it only has one button). and my desktop can be accessed without a password if the yubi is inserted (without pressing it or anything, this is slot0) or I can type my password if I want. what I thought was going to be a wild rodeo with bucking broncos and PAM module errors, turned out to be riding the coin-operated horse in front of the grocery store.

alias_neo 7y ago

I wrote a blog post on this recently, using only open-source tools that don't come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone. I'm afraid to link it here because the traffic might kill my puny box.

andyonthewings 7y ago
> I'm afraid to link it here because the traffic might kill my puny box. Setup Cloudflare, which is free and easy to use. Or, just post an Internet Archive wayback machine copy of your post would be good enough.
- askmike 7y ago
  Given that he: > I wrote a blog post on this recently, using only open-source tools that don't come from big corps. I doubt he wants to use CloudFlare ;)
  - Spivak 7y ago
    Philosophically is using CloudFlare or whatever CDN any worse that using the normal internet infrastructure in terms of software freedom?
    - askmike 7y ago
      Definitely, all traffic is readable by CloudFlare. Whereas if you have your own SSL certs everything going through the "normal internet infrastructure" is encrypted (in theory your webhost is able to get to it, but definitely not as easily - and this is only an issue if you rent a server). On top of that there are many arguments against CloudFlare when it comes to an open and decentralized internet. EDIT: didn't read the Philosophically in your comment. CloudFlare does many things against an open internet, for a long time they blocked (or required excessive captchas) for all TOR users.
mises 7y ago

xorcist 7y ago

Megacorps have their own reasons to select technology. Your best bet is probably to go with a Yubikey (or something like it). It's about $50 and it's what several of the big Linux projects themselves use so it's well tested and documented.

danieldk 7y ago
Or one of the Nitrokeys, which are generally more affordable and have open source firmware: https://www.nitrokey.com https://www.nitrokey.com
- rincebrain 7y ago
  Do they offer a good solution to the dual problem of: - if you can flash/read everything, so can an attacker - if you have a blackbox nothing can peer into, how can you trust the device?
  - oarsinsync 7y ago
    It looks like the very first FAQ answers that: 1) You generate your own root keys, to deploy onto the device, 2) You can't read the root keys back off the device once it's deployed.
    - rincebrain 7y ago
      That doesn't quite answer my question, I think. My statement was that: - if you have an opaque enclave on the device (e.g. a black box you can't peer into), you can't know what it's doing - if you don't, you can read the private key bits out Your statement was that it has a private enclave you cannot extract key material out of, which resolves the latter half of the question, but not the former, I think?

mises 7y ago

I had to do a pam config recently. Having only tweaked a few settings previously, it was kind of intimidating as I was doing some security-type stuff and had to rewrite the config. I locked myself out more times than I care to remember; thank God I was working (mostly) in virtual machines. This is especially a problem since the necessary pam settings vary from distro to distro. If you really want to, test it on a vm that replicates your machine first and make sure you document exactly what to do to get it working. To be clear, it should be fine if you're just adding a module, but sometimes getting the exact settings can be hard, so make sure to do it in a vm first and be careful. Just trying to keep others from going through what I went through.

kiallmacinnes 7y ago

If all you care about is your SSH key not being stolen, then you can very easily use a YubiKey (or other smartcard..) with SSH via either GPG or PKCS11. Both will mean your key never leaves your YubiKey (or other smartcard...). This doesn't prevent your colleagues from having their key stolen, but does protect yours. I can use the YubiKey for SSH from Linux, Mac, Android phones without issue, and I keep several YubiKeys with my keys on them so it's extremely unlikely I'll loose them all at once. Re the paranoia - if you're really the only person who can fix something, and you have lost your closest key, then - the thing in need of fixing can wait till you get home to your second key ;)

kylek 7y ago
I'm less worried about losing a hardware key than I am about something breaking in a mysterious way and locking me out! My initially question was really about personal (unshared) systems. (I don't know - a random auto-update busting a non-standard PAM module and preventing it from loading, or even something just changing the PAM configs on its own, doesn't seem impossible to me). I'd definitely keep a spare if i went the Yubi route.
- metafunctor 7y ago
  It's pretty hard to permanently get locked out. In a pinch, you can always mount the disk in another machine, fix whatever is wrong, and boot the original machine back up.
  - crtasm 7y ago
    Or if you rent a server from a provider they usually offer a rescue mode boot option.

rollthehard6 7y ago

I'd never done anything much with pam before but found it relatively easy to get PrivacyIDEA working on CentOS, it's even easier if you're using Ubuntu. https://www.privacyidea.org/ https://www.privacyidea.org/ and Cornelius is really helpful.