4 ms·
The article says to use two-factor-auth (obviously a good idea) but says nothing about HOW you add 2FA to SSH. Does anybody have pointers? I'd love to add 2FA
by oofbey 5y ago
The article says to use two-factor-auth (obviously a good idea) but says nothing about HOW you add 2FA to SSH. Does anybody have pointers? I'd love to add 2FA to my bastion hosts, but don't want to put a ton of effort into doing so.
- lnxg33k1 5y agoUsually with authentication on linux, pam is a good starting point https://duo.com/docs/duounix https://duo.com/docs/duounix
- VTimofeenko 5y agoI set up something like this [1] in the past. It relies on pam letting in the user if and only if that user provides the generated number. Do note that messing up pam is easy and may lock you out, so have a backup/snapshot, rescue shell or an open session when you are configuring it. [1]: https://ubuntu.com/tutorials/configure-ssh-2fa#1-overview https://ubuntu.com/tutorials/configure-ssh-2fa#1-overview
- seldomcomment 5y agoyou can do so also without google authenticator in a previous HN post I've copied my quick 'n dirty notes [1]: https://pastebin.com/yYzSrM61 https://pastebin.com/yYzSrM61
- beermonster 5y agoSince OpenSSH >=8.2 you can use FIDO2 and security keys. See https://www.stavros.io/posts/u2f-fido2-with-ssh/ https://www.stavros.io/posts/u2f-fido2-with-ssh/
- deleted 5y ago[deleted]
- R0b0t1 5y agoIt depends what you mean by 2FA. Older definitions allow password protected keyfiles. If you mean active 2FA, you need a PAM plugin and usually a provider, but you can host your own. Look at e.g. Yubikey.
- oofbey 5y agoI would take password-protected keyfiles - I would love it in fact. But AFAIK there's no way for the server to know if the keyfile was password protected or not. Is there? It seems like it wouldn't be reliable - you kinda have to trust the client to tell you the truth about whether or not it decrypted the keyfile before using it.
- R0b0t1 5y agoWhy does that matter? There's no way to ensure your employees aren't writing down their passwords. If you don't trust someone to follow procedure then don't employ them.
- oofbey 5y agoSecurity always exists in layers. Policy is a layer - e.g. asking people to do something. Another layer is to have a system to remind/enforce that policy. Writing down passwords is (generally) an obviously stupid thing to do, perhaps worthy of termination. But forgetting to put a passphrase on one SSH key when you regularly use a dozen of them for different purposes - this is absolutely not an offense worthy of termination.
- R0b0t1 5y agoIf that's what you need it's possible to generate and issue keys from a centralized host just like with TLS. You can even set up login with SSH/TLS certs, which can be password protected.
- old-gregg 5y agoThe blog is hosted on https://goteleport.com/ https://goteleport.com/ - the open source SSH implementation which natively supports 2FA. Full disclosure: I work there, but I am not the author.
- oofbey 5y agoIronically, I think the blog post would have been improved with some explicit self-promotion.
- nyolfen 5y agoit's pretty easy to set up TOTP 2FA using google authenticator's PAM module: https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-set-... a password-protected SSH key is also two factors
- anjbe 5y ago> a password-protected SSH key is also two factors Not really. By default SSH keys are kept in a private subdirectory of $HOME. An attacker who has access to it is very likely able to modify the user’s $PATH, trojan the passphrase prompt, and so on. Thus in many real‐world situations it collapses to one factor. Contrast that to an SSH key tied to a WebAuthn token with "ssh-keygen -t ed25519_sk"—even a fully trojaned machine would not be able to freely initiate sessions with the compromised key.
- u801e 5y agoWhat about requiring both the key and the password to authenticate?
- pigbearpig 5y agoThis post is basically an ad. "Hey look at these generic things to secure SSH, maybe you should pay us instead."
- u801e 5y agoIt's possible to configure sshd to require both password and key based authentication. That is, you have to have access to the private key and know the password. You can set this up via the RequiredAthentications2 setting off you're just using protocol V2.