Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I would like to strengthen the authentication of my SSH logins by adding another factor: a passcode generator device, or a passcode generation application on my mobile phone. The only obvious options in the default setup are a fixed password and key pair. How can I do this?

(If I use a password plus a passcode generator, this provides two-factor authentication (2FA): the password is “what I know”, and the passcode is “what I have”.)

share|improve this question
add comment

2 Answers

up vote 44 down vote accepted

One way to do this is with a tool provided by Google called Google Authenticator.

  1. Install libpam-google-authenticator Install libpam-google-authenticator

    • or just sudo apt-get install libpam-google-authenticator
  2. Edit /etc/pam.d/sshd to include the module:

    • sudoedit /etc/pam.d/sshd and then include this line at the bottom and save:
    • auth required pam_google_authenticator.so
  3. Edit your SSH config file to turn on the challenge:
    • sudoedit /etc/ssh/sshd_config and then change the response authentication from:
    • ChallengeResponseAuthentication no to
    • ChallengeResponseAuthentication yes and then save the file.
  4. sudo restart ssh to restart SSH
  5. Run google-authenticator
    • This will give you your secret key, verification code, and emergency scratch codes. It will also ask you some rate limiting questions.

Mobile Applications:

You'll need one of these to receive the authentication code on another device.

Related and Useful:

Note that combining a password with single-use passcodes is two-factor authentication: it combines “what you know” (a password) with “what you have” (the passcode generator device). On the other hand, if you combine single-use passcodes with an SSH key pair, it's all about “what you have”. When two authentication factors are of the same type, you do not have two-factor authentication; this is sometimes called “one-and-a-half-factor authentication”.

share|improve this answer
    
Tried this on Precise, worked perfectly - has anyone found this for Lucid? –  phalacee Jul 5 '12 at 7:27
    
And if you're using Puppet, there's a puppet module here: github.com/camptocamp/puppet-googleauthenticator –  ℝaphink Aug 8 '12 at 22:40
add comment

Google Authenticator is fine for your personal servers but you might find that it doesn't tie in well with your existing identity infrastructure. If you want to explore other options think about using RADIUS as an authentication protocol and the pam-radius plugin. All the enterprise-oriented two-factor authentication systems support radius. We have written a doc on how to add WiKID two-factor authentication via pam-radius to Ubuntu.

Using radius allows you to tie in other systems besides SSH to the same authentication server. You can also route auth requests through freeradius to LDAP and then to your 2FA server to separate authorization from authentication. You can do the same with AD btw.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.