How To Configure MFA on Centos and Ubuntu with Google Authenticator

by Anish


Posted on Friday October 18/2019


Referefce 8gwifi.org

Before We Begin:-

Authentication factor can be of following types: (CISSP Stuff)

  • Something you know: A secret or password or PIN
  • Something you have: Smart card / token / Mobile Phone
  • Something you are: Facial Recognition, Biometrics

Single factor authentication uses one of the types mentioned above as their authentication mechanism for example use of a password to connect to your Linux server

A good example of two-factor authentication is the performing online Transaction, in this case

  • Something you know : The Bank user credentials
  • Something You have : Phone Number linked with account used to sent OTP for the Two step verification

In this tutorial we will configure our friend SSH to go with MFA, but before that let's take a small chit-chat on TOTP: Time-Based One-Time Password Algorithm

TOTP : The Time-based One-Time Password algorithm (TOTP) is an extension of the HMAC-based One-time Password algorithm (HOTP) generating a one-time password by instead taking uniqueness from the current time.

Google Authenticator is a software-based authenticator that implements two-step verification services using the Time-based One-time Password Algorithm and to achive 2FA in Centos and Ubuntu we will be using google-authenticator-libpam PAM Module.

Let's begin the configuring Google Authenticator PAM Module

  • Tested on Ubuntu 16.04/18.04
  • Centos7

1. Install google-authenticator

  • Ubuntu
sudo apt-get install libpam-google-authenticator
  • Centos
yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum install google-authenticator

2. Edit the configuration files

  • Edit /etc/pam.d/sshd and add this directive add it in the beginning of the file. In this way the system will ask first authentication code and only then will ask password.

    # Google Authenticator
    auth required pam_google_authenticator.so
    
  • Edit /etc/ssh/sshd_config and modify or add these directives:

    ChallengeResponseAuthentication yes
    UsePAM yes
    PasswordAuthentication no
    

3. Activate the two-factor authentication for a user

Switch to the user who should use the two-factor authentication and type in the terminal:

[[email protected] ~]$ google-authenticator

Google Authenticator Configuration

O4IRDBDELSPSEWFXF2USVKIXIY
Your verification code is 560634
Your emergency scratch codes are:
33932408 43900036 59855459 94779765 560436451

you can also find these details in the user home location

[email protected] ~$ cat .google_authenticator
O4IRDBDELSPSEWFXF2USVKIXIY
RATE_LIMIT 3 30
WINDOW_SIZE 17
DISALLOW_REUSE
TOTP_AUTH
33932408
43900036
59855459
94779765
56043645

Google Authenticator Configuration

4. Generate TOTP codes

The Secret Key O4IRDBDELSPSEWFXF2USVKIXIY is used to generate the Authentication code

We will use the Google Authenticator app available for Android (in the Play Store) and iOS (in iTunes) to generate authentication codes.

Google Authenticator Code Generated from the APP

5. Testing


[[email protected] /]# ssh [email protected]
Verification code: 
Password: 
Last login: Fri Oct 18 08:34:22 2019 from 1242d27bd57c

6. Demo

Centos Video Demo

Ubuntu Video Demo


Next Reading Twenty Step to Harden SSH



Thanku for reading !!! Give a Share for Support

Asking for donation sound bad to me, so i'm raising fund from by offering all my eight book for just $9

Referefce 8gwifi.org
Online Terminals
Online Terminals
python Cryptography Topics
Topics
For Coffee/ Beer/ Amazon Bill and further development of the project Support by Purchasing, The Modern Cryptography CookBook for Just $9 Coupon Price

Kubernetes for DevOps

Hello Dockerfile

Cryptography for Python Developers

Cryptography for JavaScript Developers

Go lang ryptography for Developers