14 ms·
Add two-factor authentication to your ssh in 30 seconds
- msie 14y agoI can't wait until three-factor authentication!!!
- jfaucett 14y agoyes exactly what I've been looking for, awesome tool! Thanks for sharing.
- SanjayUttam 14y agoGreat idea
- pejoculant 14y agoPretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/ https://code.google.com/p/google-authenticator/
- dcu 14y agothe problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?
- pejoculant 14y agoI think it still requires your normal password as well, so the server wouldn't be lost unless someone had both.
- mbreese 14y agoIt's two-factor authentication: something you have (phone) and something you know (password to your ssh cert). So, you have to lose both in order to lose the server.
- natrius 14y agoI don't think this is the case. Losing either loses the server in the sense that you won't be able to access it. The fix is that the "something you have" is both your phone and emergency codes.
- mbreese 14y agoIn security, losing the server doesn't mean losing access to the server. Losing the server means that someone else has access to the server, as in an adversary. Yes, if you lose either factor, you can't access the server. This is why with Google Authenticator you also get a one time pad with emergency codes. However, I don't know how well this would work with two-factor SSH... you'd need a separate one time pad for each server. And I'm not sure how the Google PAM module handles emergency codes.
- brendn 14y agoNo, both authentication factors are required, so either losing your phone or forgetting your password would be sufficient to lock you out. However, the Google authenticator PAM plugin provides emergency access codes to use in the case that the one-time password generator is not available.
- 0x0 14y agoIf you mean lose access to the server, then the google-authenticator sets you up with a few emergency one-time codes you could write down on a note and keep safe, in case your phone is lost.
- fffggg 14y agoNot to mention you can write down the seed itself and simply type it into another phone.
- jordibunster 14y agoI don't think google-authenticator does that, I think Gmail does that.
- 0x0 14y agoThere's a bunch of references to scratch codes in the pam google-authenticator module, but I haven't actually tried to run the code. http://code.google.com/p/google-authenticator/source/browse/libpam/google-authenticator.c#621 http://code.google.com/p/google-authenticator/source/browse/...
- conroe64 14y agoIf you are talking about not being able to log into the server anymore, you can make backups of the seed. On android, you just need to pull the file "/data/data/com.google.android.apps.authenticator2/databases/databases" off the phone.
- ben1040 14y agoThis only works if your phone has been rooted.
- mootothemax 14y agothe problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right? If you lose your phone and your scratch codes, you've only lost access via SSH. So it's an inconvenience, but one you can overcome with the right setup.
- drivebyacct2 14y agoWell, if that were the case, when I lose my phone (sadly, not if), I would be locked out of years of Google account data. Fortunately there are backup codes. (And for Google a phone number call/text recovery path).
- mryan 14y agoSeconding the recommendation for PAM/Google Authenticator. Off-topic: Has anyone ever managed to get PAM/Google Authenticator working with RADIUS? I spent a while messing about with this last year, and never got it working exactly as I had hoped. I'm no longer working with RADIUS, but this post reminded me I never finished scratching that geeky itch.
- bithive123 14y agoI wrote a Sinatra app to act as a Google Authenticator backend for our FreeRADIUS instance as well as our web SSO. It also handles enrollment via generating QR codes: http://it.isevil.org/blog/2011/11/13/authentication-service-using-google-authenticator/ http://it.isevil.org/blog/2011/11/13/authentication-service-... Code: https://github.com/bithive/example-totp-vault https://github.com/bithive/example-totp-vault For FreeRADIUS we use rlm_perl to define our own authenticate() method; it just calls the web service to validate the codes.
- mryan 14y agoNeat solution, thanks for sharing.
- seanponeil 14y agoI can't speak for Google Authenticator but Duo works great with RADIUS http://www.duosecurity.com/docs/radius http://www.duosecurity.com/docs/radius
- dlokshin 14y agoI've been using Duo Security for two factor auth and have been very happy with it (also easy to set up). Free for all open source projects.
- tylermenezes 14y agoBeen using this for around a month and it's great. Highly recommended.
- subway 14y agoYou should really package this up, and provide a signed repo instead of relying on the busted SSL infrastructure and GitHub to provide security to your users. While this one isn't quite as offensive as some, all these curl/sudo/bash combos really make me sad, particularly when used to "increase" security.
- danielpal 14y agoYou are right. Best for your infrastructure is to fork it and modify it. We for example have a different version we use for chef and that already include everyone's keys.
- eslachance 14y agoThis is great but one thing bugs me. When you add a new user, you have to restart SSH? Wouldn't that prevent people from connecting every time a new user is added?
- danielpal 14y agoNo, when you add a new user you don't need to restart. Only restart the server when you install the plugin.
- eslachance 14y agoThe video in your blog post makes this murky to understand. First, the screen says "Restart the server to apply any changes". Second, you enable Authy for root, and then restart the server and say "Remember to restart ssh so the new configuration takes effect". Perhaps I'm not linux-oriented enough, but for me "configuration" doesn't just mean system config - adding a user could be part of that definition. Otherwise though, I do think that this is an awesome idea. It only needs apps for smarphones instead of sending an SMS and you're on part with Google and Battle.net :)
- dcu 14y agoAuthy offers apps for smartphones. I think you can see the Authy app running on an iphone in the video.
- dcu 14y agoEven if you restart the ssh server it won't prevent people from connecting to the server because SSH forks the clients.
- eslachance 14y agoAh, that clears it up. Thank you!
- a3_nm 14y agoDoes this mean that you ping them whenever you ssh? Does this mean that if their service is down you won't be able to ssh anymore?
- piotrSikora 14y agoFrom https://github.com/authy/authy-ssh/blob/master/authy-ssh#L112 https://github.com/authy/authy-ssh/blob/master/authy-ssh#L11...: Default action when api.authy.com cannot be contacted: 1. Disable two factor authentication until api.authy.com is back 2. Don't allow logins until api.authy.com is back
- ikonst 14y agoWhat?! This is an online method? Why don't people just use Google Authenticator? It's totally offline, on both ends.
- uptown 14y agoThe video shows two options for this situation. Either allow access despite the outage, or deny access due to the outage.
- stcredzero 14y agoHas anyone added this to other than a server? Seems like this could be added to a notebook or desktop running OS X. (And for that, I would actually prefer Google Authenticator.) Also, it occurs to me: With TFA, it finally makes sense to periodically change passwords.
- dsl 14y agoIf you are looking for a clean reliable two-factor auth system, I highly recommend Duo: http://www.duosecurity.com/ http://www.duosecurity.com/ I've been using them across a half dozen personal machines for quite a while now, looking to roll it out at work as well.
- davidblondeau 14y agoRight, Duo is great. Love the fact you can install it over the whole enterprise including applications, blogs (Wordpress), vpns, and ssh.
- cs702 14y agoUsing a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator; second, run google-authenticator as the user you will access remotely and follow the instructions; then, edit /etc/pam.d/sshd, and add "auth required pam_google_authenticator.so" in a new line; edit /etc/ssh/sshd_config and add (or change) the ChallengeResponseAuthentication line so it reads "ChallengeResponseAuthentication yes"; and finally, sudo service ssh restart to restart the ssh server. More info is available from the packager of libpam-google-authenticator[1], and from the Google Authenticator PAM module's README.[2] -- [1] http://blog.theroux.ca/security/ubuntu-2-step-authentication-with-google-authenticator/ http://blog.theroux.ca/security/ubuntu-2-step-authentication... [2] http://code.google.com/p/google-authenticator/source/browse/libpam/README http://code.google.com/p/google-authenticator/source/browse/... -- Edits: Corrected typos; added more context.
- danielpal 14y agoThe biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.
- cs702 14y agodanielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)
- danielpal 14y agoYeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.
- peterwwillis 14y agoSMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc. If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.
- danielweber 14y agoDon't let the perfect be the enemy of the good.
- peterwwillis 14y agoCan I quote you on that when the first "flaw in SMS used to circumvent two factor authentication" article comes out? A secured data connection is much better than SMS and easy to implement. But this is still a 'something you send' factor, which can be intercepted. A physical token or 'something you have' is more secure, and can also be easily implemented with a YubiKey, a paypal/ebay authentication card, etc. If you think your data is so valuable someone might install a keylogger to get it, you might as well secure it as well as you reasonably can.
- danielweber 14y agoIn order for a flaw in SMS to break someone in, the attacker would need to break both SMS and the traditional authentication channel. Yes, SMS can be broken. I'm sure Google Authenticator is vulnerable to certain attacks, too. Using them is better than throwing your hands up in the air and saying "it's not perfect, we'd better not implement it because then people will act as if they have perfect security!" Because people are already acting like they have perfect security.
- peterwwillis 14y agoYou know this is the same reason people keep using telnet to manage their routers. "To attack the protocol would be like totally hard, and upgrading the routers to use ssh would be a pain in the ass. Telnet isn't perfect but it's better than nothing!" Yeah, SMS isn't perfect, and yeah, it's better than nothing. But you know what else is better than nothing? Properly implemented TLS from an app or website on the phone. Of course that has holes too, but it's encrypted and (hopefully) authenticated unlike SMS. And it's available in every phone that can do SMS (unless you don't pay for data). You can do whatever you want. But if you give people a crappy option and a good option, and the crappy option is slightly easier, they'll use the crappy option. But if they want the extra security they'll use the extra click it takes to make the good option work. Most people will just reason that nobody will ever use a keylogger on them and keep using keys with passwords.
- cmsj 14y agoIn the video I see a private key coming from a Dropbox folder :( Missing. The. Point.
- jimktrains2 14y agoI didn't watch the video, but if the key is encrypted (password protected) like it should be, what's the problem?
- a_bonobo 14y agoIn the comments the author states that his private key is inside a TrueCrypt-folder, and that folder is on Dropbox. I know that's reasonably secure but it feels terrible.
- tedunangst 14y agossh key encryption isn't "lengthened" (it turns the password into the encryption key in the most obvious way possible). Unless your password is of the epic norse poem variety, it's crackable.
- aclimatt 14y agoSeriously? Another (virtual) token-based 2FA solution? What is your competitive advantage against Duo, Authentify, Entrust, and the thousand other SMS or virtual token 2FA solutions out there?
- danielpal 14y agoWe make it really easy for anyone to use 2FA. The reason 2FA is not popular is not because there aren't enough solutions out there, it's because all of them are basically really hard to use. Specially those that claim to be easy, they are the opposite.
- aclimatt 14y agoA valid goal, but I think you're misunderstanding your market: in your words, people don't use 2FA because it's hard to use -- not hard to implement. Organizations who have IT teams are fully capable of implementing reasonable APIs like what Duo or Google offers. But you'll realize that enterprises don't even care about the architecture, because they'll be paying you to implement it anyway. No, the reason nobody (in and only in the US) uses 2FA (because nearly every other country in the world uses it widely) is because it's a pain to use for the end user. No enterprise is going to invest their time and energy into a solution unless they're either required to by regulations or is truly better, easier, more secure, or whatever than competing solutions to make it a compelling sale. If this were a hobby project then I'd be cheering you on -- why not make a token 2FA with a slightly better API? But as a YC-funded company whose likely avenue of success will be through the enterprise market, you NEED to develop a product that is better, faster, easier, more secure, etc than your (rather formidable) competition. Trust me, I'm familiar with this market ;).
- deleted 14y ago[deleted]
- raffpaquin 14y agoSimple and great idea
- darklajid 14y agoI added support for yubikey to my installation. That thing's always on my keychain and can be used as second factor or otp generator (or both).
- mbq 14y agoOne more option is Barada PAM module+Android app. http://barada.sourceforge.net/ http://barada.sourceforge.net/ It is basically a HOTP implementation, where the token is protected by PIN (with PIN being a missing part of the shared secret stored on the token) and the original password is reserved only to be used on trusted machines (or) in case of losing token.
- bbromhead 14y agoFairly certain port forwarding still works while a command specified in ForceCommand is still running or if you specify a non-interactive shell. Though I haven't checked ;)
- amirmansour 14y agoThis is awesome. I wish the people at Authy the best. Now I'm gonna 2-factor auth the hell out of everything.
- gizzlon 14y agoHm, can somebody explain what threat two-factor ssh-login is a response to? If somebody went through the trouble of owning your machine, can't they bypass the two-factor as well? Yes, it requires a more "live" and target attack, but one would think ssh attacks like these are pretty targeted in the first place. Or? What am I missing?
- darklajid 14y agoMaybe I'm missing some assumptions of yours, but for me the reason to do that is to .. protect the ssh login. Who talks about a machine that is owned? This is about an additional requirement to log on to a service, be it ssh or email. Whether you're reusing your password, sharing it or just use a really bad one this adds an additional step to impersonate you.
- gizzlon 14y agoYeah, but you can log-in with private keys instead of passwords, so that problem was solved a long time ago.
- peacetara 14y agoWhat about two-factor authentication for sudo? I'd rather start my users off with sudo 2 factor auth, and grow them into two-factor auth for ssh and other stuff.