Posted on Friday October 18/2019
Before We Begin:-
Authentication factor can be of following types: (CISSP Stuff)
Single factor authentication uses one of the types mentioned above as their authentication mechanism for example use of a password to connect to your Linux server
A good example of two-factor authentication is the performing online Transaction, in this case
In this tutorial we will configure our friend SSH to go with MFA, but before that let's take a small chit-chat on TOTP: Time-Based One-Time Password Algorithm
TOTP : The Time-based One-Time Password algorithm (TOTP) is an extension of the HMAC-based One-time Password algorithm (HOTP) generating a one-time password by instead taking uniqueness from the current time.
Google Authenticator is a software-based authenticator that implements two-step verification services using the Time-based One-time Password Algorithm and to achive 2FA in Centos and Ubuntu we will be using google-authenticator-libpam PAM Module.
Let's begin the configuring Google Authenticator PAM Module
sudo apt-get install libpam-google-authenticator
yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm yum install google-authenticator
/etc/pam.d/sshd and add this directive add it in the beginning of the file. In this way the system will ask first authentication code and only then will ask password.
# Google Authenticator auth required pam_google_authenticator.so
/etc/ssh/sshd_config and modify or add these directives:
ChallengeResponseAuthentication yes UsePAM yes PasswordAuthentication no
Switch to the user who should use the two-factor authentication and type in the terminal:
[[email protected] ~]$ google-authenticator
O4IRDBDELSPSEWFXF2USVKIXIY Your verification code is 560634
Your emergency scratch codes are:
33932408 43900036 59855459 94779765 560436451
you can also find these details in the user home location
[email protected] ~$ cat .google_authenticator O4IRDBDELSPSEWFXF2USVKIXIY RATE_LIMIT 3 30 WINDOW_SIZE 17 DISALLOW_REUSE TOTP_AUTH 33932408 43900036 59855459 94779765 56043645
The Secret Key O4IRDBDELSPSEWFXF2USVKIXIY is used to generate the Authentication code
We will use the Google Authenticator app available for Android (in the Play Store) and iOS (in iTunes) to generate authentication codes.
[[email protected] /]# ssh [email protected] Verification code: Password: Last login: Fri Oct 18 08:34:22 2019 from 1242d27bd57c
Next Reading Twenty Step to Harden SSH
Thanku for reading !!! Give a Share for Support
Asking for donation sound bad to me, so i'm raising fund from by offering all my Nine book for just $9