55

I would like to strengthen the authentication of my SSH logins by adding another factor: a passcode generator device, or a passcode generation application on my mobile phone. The only obvious options in the default setup are a fixed password and key pair. How can I do this?

(If I use a password plus a passcode generator, this provides two-factor authentication (2FA): the password is “what I know”, and the passcode is “what I have”.)

0

3 Answers 3

49

One way to do this is with a tool provided by Google called Google Authenticator.

  1. Install libpam-google-authenticator Install libpam-google-authenticator

    • or just sudo apt-get install libpam-google-authenticator
  2. Edit /etc/pam.d/sshd to include the module:

    • sudoedit /etc/pam.d/sshd
    • and then include this line at the top of the file and save:

      auth required pam_google_authenticator.so
      
  3. Edit your SSH config file to turn on the challenge:

    • sudoedit /etc/ssh/sshd_config and then change the response authentication from:

      ChallengeResponseAuthentication no 
      

      to

      ChallengeResponseAuthentication yes
      

      and then save the file.

  4. sudo restart ssh to restart SSH

  5. Run google-authenticator

    • This will give you your secret key, verification code, and emergency scratch codes. It will also ask you some rate limiting questions.

Mobile Applications:

You'll need one of these to receive the authentication code on another device.

Related and Useful:

Note that combining a password with single-use passcodes is two-factor authentication: it combines “what you know” (a password) with “what you have” (the passcode generator device). On the other hand, if you combine single-use passcodes with an SSH key pair, it's all about “what you have”. When two authentication factors are of the same type, you do not have two-factor authentication; this is sometimes called “one-and-a-half-factor authentication”.

1
  • In Ubuntu 22.04 the ChallengeResponseAuthentication is replaced by KbdInteractiveAuthentication in /etc/ssh/sshd_config.
    – mark
    Apr 22, 2022 at 19:14
12

Google Authenticator is fine for your personal servers but you might find that it doesn't tie in well with your existing identity infrastructure. If you want to explore other options think about using RADIUS as an authentication protocol and the pam-radius plugin. All the enterprise-oriented two-factor authentication systems support radius. We have written a doc on how to add WiKID two-factor authentication via pam-radius to Ubuntu.

Using radius allows you to tie in other systems besides SSH to the same authentication server. You can also route auth requests through freeradius to LDAP and then to your 2FA server to separate authorization from authentication. You can do the same with AD btw.

1

I urge everybody to put the following line at the top and not at the bottom of /etc/pam.d/sshd as described above previously (now corrected):

auth required pam_google_authenticator.so

Otherwise your system will remain open to brute force attacks on your password, comprimising the first part of the two-factor authentication: your password.

You will be asked first for your verification code, and then your password (regardless if the code was correct). If either one is wrong you need to enter both again. You can configure it the other way around but that's a bit more difficult change to describe in the current default ubuntu (15.04) sshd configuration.

For details why it's needed, check this issue:

https://github.com/google/google-authenticator/issues/514

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .