The title pretty much says it. I have been hearing more about 2 factor authentication, one-time passwords, hard-tokens, and other improved security features. With the decreasing security of using just a password, I want to know how I can improve my security on Ubuntu. I am using 14.04 LTS with Unity.
You can use the open-source Pluggable Authentication Module (PAM) created by Google, known as the Google Authenticator. This module is available in the standard repositories, as well as from GitHub so that you can build from source. Coupled with the Android, iOS, or Blackberry App of the same name, it creates time-based, time-sensitive codes for authentication along with your password. Since it is a PAM module, it can be dropped in pretty much anywhere. Let's get started!
To start, you can install the PAM with the following:
Setting it up:
After it's installed, you will want to also install the corresponding mobile application for Android, iOS, or Blackberry (depending on your mobile platform). Each one is useless without the other. After you have the application you need for your mobile device, run the following in a terminal:
This will start by asking you a few questions The first one is the only one which you must answer "Yes" to, and it asks if you want the codes to be time-based. After that, read each question and make the choice that makes the most sense to you.
Upon completing the initial set-up, you will see a very large QR code in your terminal, as well as some other information. The line that says "Your New Secret Key Is:" is a much needed line if you don't want to use the QR code for pairing your device, so don't close this window until you are set-up! The "scratch codes" this gives you are also important, as they are what you will use to log-in if you lose your mobile device. Write them down and store them somewhere safe.
Now, on your mobile device, open your Google Authenticator application and select "Set up account". You can either scan the QR code that was generated, or select "Use provided key". If you scan the QR code, everything will be automatically saved under an account named "your_user@your_host". However, if you select "Use provided key", you will have to enter a name, key, and type of token manually. The name can be anything you wish. The key would be the secret key previously generated. The type would be the default time-based. After setting it up, you will see the account on the main pane of the Google Authenticator app, as well as a circle-shaped timer next to it. That timer depletes every 30 seconds, and a new code is generated.
Here comes the magic. Since this is a PAM module, it can be used in a variety of places. I will walk through adding authentication to
I'm doing this one first because there is an extra step. The first thing you need to do is to edit your SSH config file:
Search for the line that says:
and change the "no" to a "yes".
Now, you need to edit the PAM module for ssh:
At the very end of this file, add the following line:
The "nullok" argument tells the system to not request a verification code if a user has not set-up two factor authentication. After that edit, go ahead and restart your ssh service: