6 ms·

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your c

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

cs702 14y ago
danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)
- danielpal 14y ago
  Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.
  - halostatue 14y ago
    My scratch codes are in 1Password (for my personal accounts) and LastPass (for work accounts).
    - charliepark 14y ago
      People really should do this. It takes 10 seconds, and eliminates having any paper to lose (or keep secure). Copy and paste, and you're done.
  - Karunamon 14y ago
    >Yeah but in reality no-one writes it down. Then that's a process problem that can be solved. It would take a trivial amount of time to screenshot the page and stash them in your wiki or similar.
  - arjunnarayan 14y ago
    Mine are written down in a post-it note stuck to the inside back-flap of my passport.
  - ikonst 14y ago
    You can use the same key for all the servers. Just copy the files generated by the 'google-authenticator' app. I don't see any less security in that.
  - dalore 14y ago
    Mine are printed out and stored in my safe. They are never used.
  - pooriaazimi 14y ago
    Those who don't write it down deserve to be locked out. I've written down mine on three different pieces of paper (in my wallet, my bag and my closet), and also took a screenshot from it and `gpg`-ed it (with a passphrase, so no one can open it unless they know the password) and stored it in a few online repositories, as well as a friend's mailbox. So, I'll never be locked out from my account.
    - jonny_eh 14y ago
      It's the only sane thing to do!
  - duaneb 14y ago
    > Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain. This is your problem. I keep mine (for multiple services) in my wallet, and it's worked out excellently.
keidian 14y ago
You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn't pass it. Not the best way, but one option. I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can't find the link right off though as I'm at work currently. If I find it, I'll add it here
- j_s 14y ago
  A ForceCommand example (for Yubikey) is documented here: http://www.tuxz.net/blog/archives/2010/03/17/how_to_quickly_setup_two-factor_ssh_authentication/ http://www.tuxz.net/blog/archives/2010/03/17/how_to_quickly_...
- rsync 14y ago
  Yes, I have seen a patch as well that allowed you to require both an ssh key and a password ... it was an old patch, though, and I can't imagine it would apply cleanly to any recent OpenSSH ... This is on our list to pay for someone to do, and we'll release it when they do ... it will probably be FreeBSD-centric, but if it's against OpenSSH generally, it should be usable by others...
jlgreco 14y ago
Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication). If not, it might be possible to configure PAM with some sort of keys module set to 'sufficient', then have PAM fall back on two-factor auth paired with pam_unix. In fact, I'll see if I can get either of those working a bit later today. Seems like it could be neat.
- guiambros 14y ago
  Another option is to whitelist your ip address, and then require 2-factor auth only when you're connecting from a non-whitelisted ip address. Of course this leaves you a vulnerable to ip spoofing, but adds a ton of convenience and could be a good trade-off.
  - meik 14y ago
    Yeah but (blind) IP spoofing over the Internet is infeasible nowadays. Maybe 15 years ago when ISN randomization was not the rule (successful attack described in http://web.textfiles.com/hacking/shimomur.txt http://web.textfiles.com/hacking/shimomur.txt) But that's correct, in recent openssh versions, it seems that you can add specific-host-only rules for authentication etc.
ikonst 14y ago
I use ssh keys with this setup. If I login with an ssh key, I don't need the OTP.
- vegardx 14y ago
  How did you manage to do this? You'd have to use PAM for this to work, and PAM and key-based authentication is mutually exlusive, as far as I know.
dalore 14y ago
What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.
- count 14y ago
  And how do you do that with cloud instances? :)
  - Ralith 14y ago
    Same way you do when you forget the root password on a normal configuration.
  - pixelcort 14y ago
    Some VPS providers offer "console" access to the machine, which would probably allow someone to drop down into single user mode. http://www.linode.com/faq.cfm#do-you-provide-console-access http://www.linode.com/faq.cfm#do-you-provide-console-access
  - justincormack 14y ago
    Install a new instance! Its all disposable hardware.
gregwebs 14y ago
If you use a google voice number you can just point it to a new phone.
- justincormack 14y ago
  Don't you need to login to do that? Using 2 factor auth..
  - ikonst 14y ago
    Yes, so use your backup keys, or a secondary phone number, or a secondary email address... plenty of options.

cs702 14y ago

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

danielpal 14y ago
Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.
- halostatue 14y ago
  My scratch codes are in 1Password (for my personal accounts) and LastPass (for work accounts).
  - charliepark 14y ago
    People really should do this. It takes 10 seconds, and eliminates having any paper to lose (or keep secure). Copy and paste, and you're done.
- Karunamon 14y ago
  >Yeah but in reality no-one writes it down. Then that's a process problem that can be solved. It would take a trivial amount of time to screenshot the page and stash them in your wiki or similar.
- arjunnarayan 14y ago
  Mine are written down in a post-it note stuck to the inside back-flap of my passport.
- ikonst 14y ago
  You can use the same key for all the servers. Just copy the files generated by the 'google-authenticator' app. I don't see any less security in that.
- dalore 14y ago
  Mine are printed out and stored in my safe. They are never used.
- pooriaazimi 14y ago
  Those who don't write it down deserve to be locked out. I've written down mine on three different pieces of paper (in my wallet, my bag and my closet), and also took a screenshot from it and `gpg`-ed it (with a passphrase, so no one can open it unless they know the password) and stored it in a few online repositories, as well as a friend's mailbox. So, I'll never be locked out from my account.
  - jonny_eh 14y ago
    It's the only sane thing to do!
- duaneb 14y ago
  > Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain. This is your problem. I keep mine (for multiple services) in my wallet, and it's worked out excellently.

keidian 14y ago

You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn't pass it. Not the best way, but one option. I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can't find the link right off though as I'm at work currently. If I find it, I'll add it here

j_s 14y ago
A ForceCommand example (for Yubikey) is documented here: http://www.tuxz.net/blog/archives/2010/03/17/how_to_quickly_setup_two-factor_ssh_authentication/ http://www.tuxz.net/blog/archives/2010/03/17/how_to_quickly_...
rsync 14y ago
Yes, I have seen a patch as well that allowed you to require both an ssh key and a password ... it was an old patch, though, and I can't imagine it would apply cleanly to any recent OpenSSH ... This is on our list to pay for someone to do, and we'll release it when they do ... it will probably be FreeBSD-centric, but if it's against OpenSSH generally, it should be usable by others...

jlgreco 14y ago

Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication). If not, it might be possible to configure PAM with some sort of keys module set to 'sufficient', then have PAM fall back on two-factor auth paired with pam_unix. In fact, I'll see if I can get either of those working a bit later today. Seems like it could be neat.

guiambros 14y ago
Another option is to whitelist your ip address, and then require 2-factor auth only when you're connecting from a non-whitelisted ip address. Of course this leaves you a vulnerable to ip spoofing, but adds a ton of convenience and could be a good trade-off.
- meik 14y ago
  Yeah but (blind) IP spoofing over the Internet is infeasible nowadays. Maybe 15 years ago when ISN randomization was not the rule (successful attack described in http://web.textfiles.com/hacking/shimomur.txt http://web.textfiles.com/hacking/shimomur.txt) But that's correct, in recent openssh versions, it seems that you can add specific-host-only rules for authentication etc.

ikonst 14y ago

I use ssh keys with this setup. If I login with an ssh key, I don't need the OTP.

vegardx 14y ago
How did you manage to do this? You'd have to use PAM for this to work, and PAM and key-based authentication is mutually exlusive, as far as I know.

dalore 14y ago

What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.

count 14y ago
And how do you do that with cloud instances? :)
- Ralith 14y ago
  Same way you do when you forget the root password on a normal configuration.
- pixelcort 14y ago
  Some VPS providers offer "console" access to the machine, which would probably allow someone to drop down into single user mode. http://www.linode.com/faq.cfm#do-you-provide-console-access http://www.linode.com/faq.cfm#do-you-provide-console-access
- justincormack 14y ago
  Install a new instance! Its all disposable hardware.

gregwebs 14y ago

If you use a google voice number you can just point it to a new phone.

justincormack 14y ago
Don't you need to login to do that? Using 2 factor auth..
- ikonst 14y ago
  Yes, so use your backup keys, or a secondary phone number, or a secondary email address... plenty of options.