3 ms·

it's pretty easy to set up TOTP 2FA using google authenticator's PAM module: https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authent

it's pretty easy to set up TOTP 2FA using google authenticator's PAM module: https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-set-... a password-protected SSH key is also two factors

anjbe 5y ago
> a password-protected SSH key is also two factors Not really. By default SSH keys are kept in a private subdirectory of $HOME. An attacker who has access to it is very likely able to modify the user’s $PATH, trojan the passphrase prompt, and so on. Thus in many real‐world situations it collapses to one factor. Contrast that to an SSH key tied to a WebAuthn token with "ssh-keygen -t ed25519_sk"—even a fully trojaned machine would not be able to freely initiate sessions with the compromised key.
- u801e 5y ago
  What about requiring both the key and the password to authenticate?