9

I recently enabled two-factor-authentication using google-authenticator on my SSH server. However I am now facing a problem:

I have a different group of users on my server which I am using for SFTP, but that group is no longer able to login since 2FA isn't set up for the users in the group. Is it possible to disable the google-authenticator module for that group? Enabling it for the users in the group is not an option because multiple users will be using this account.

PS: I use openssh-server

12

You can use pam_succeed_if module (see manual page) before the pam_google_authenticator to skip this part for your group:

# the other authentication methods, such as @include common-auth
auth [success=1 default=ignore] pam_succeed_if.so user ingroup group
auth required pam_google_authenticator ...
  • 2
    It should probably be [success=1 default=ignore] instead of required. Right now, a user not in group will lead to the authentication failing, I think. success=1 will make it skip the next method, default=ignore will mean users not in group will simply move on to the next method. – muru Dec 27 '16 at 10:55
  • @muru yes, you are obviously right. Still learning the details and all the magic of the PAM stack :) – Jakuje Dec 27 '16 at 11:00
  • Is this dependent on whether you have multiple "AuthenticationMethods" in /etc/ssh/sshd_config ? With the above line added, I still get 'Permission denied (keyboard-interactive)' – Arj May 15 '18 at 14:06
  • @Arj this means you have different configuration so this specific answere does not apply for you. – Jakuje May 15 '18 at 15:01
1

Some SFTP clients can handle 2FA. For example, I'm using 2FA with FileZilla and WinSCP and they works. Also I have setup ssh-key authentication and it works alongside of 2FA.

However your question is interesting and I made a short survey. I found this answer.

So, it is possible (and easy) to run separate ssh instances. I'm already tested it.

  1. Make separate copies of sshd_config file.

    $ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_pwd
    $ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_2fa
    
  2. Edit these new config files. One of the things you must change is the shh port. According to the example:

    2.a) sshd_config_pwd specific lines are:

    Port 1022
    ...
    PasswordAuthentication yes
    ChallengeResponseAuthentication no
    UsePAM no
    

    2.b) sshd_config_2fa specific lines are:

    Port 2022
    ...
    PasswordAuthentication no
    ChallengeResponseAuthentication yes
    UsePAM yes
    
  3. Open the necessary ports into the firewall. According to the example:

    $ sudo ufw limit 1022
    $ sudo ufw limit 2022
    
  4. Run the new ssh instances:

    $ sudo /usr/sbin/sshd -f /etc/ssh/sshd_config_pwd
    $ sudo /usr/sbin/sshd -f /etc/ssh/sshd_config_2fa
    

That's it.

  • How is this answering the question? What you modify in the sshd_config to use different PAM stack and not use 2FA? – Jakuje Dec 27 '16 at 14:14
  • @Jakuje I've updated my answer. – pa4080 Dec 27 '16 at 15:49
  • Ok, so the point is "not using PAM". It might work in some cases, but PAM is not only about authentication, but also setting up session and lot more, therefore it might stop working from day to day. Also changing port is very confusing, especially if you want third party to connect to your server. Though yes, possible solution. – Jakuje Dec 27 '16 at 15:53
  • Yes, it's just a possible solution, which still incomplete, because I don't know elegant way to start these separate ssh instances at system startup. – pa4080 Dec 27 '16 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.