3 ms·
Are there yer any two-factor companion mobile apps that would increase SSH agent security locally (asks permission to use the agent key) or remotely (extra fact
by miohtama 5y ago
Are there yer any two-factor companion mobile apps that would increase SSH agent security locally (asks permission to use the agent key) or remotely (extra factor of authentication when login)?
- phonethrowaway 5y agoI've seen PAM modules for otp/totp, but that really only adds security if authenticating against a remote machine, if you validate the second factor locally doesn't that still open you to mitm or other exploits? Can you trust your own environment?
- InvaderFizz 5y agoFor Mac users, there is this: https://github.com/TimidRobot/mac-ssh-confirm https://github.com/TimidRobot/mac-ssh-confirm Doesn't add 2FA so much as it prompts you for each agent use. On the remote end, you can enable 2FA for logging into the server with libpam-google-authenticator.
- metafunctor 5y agoThere's also this to use a key in the Secure Enclave and Touch ID to confirm authentication: https://github.com/sekey/sekey https://github.com/sekey/sekey
- judge2020 5y agoDuo also has a PAM module if you'd rather use a push notification https://duo.com/docs/duounix https://duo.com/docs/duounix
- benlivengood 5y agohttps://www.stavros.io/posts/u2f-fido2-with-ssh/ https://www.stavros.io/posts/u2f-fido2-with-ssh/ goes over using FIDO2 devices with ssh, including storing the secret keys on the hardware. In that sense the passphrase becomes the second factor I guess.