Sikre SSH adgang med Google Authenticator

Vi kan SSH logge ind på en Linux/Unix server ved enten at benytte en adgangskode eller ved at benytte SSH Keys/Certifikater – også kendt som Passwordless Authentication. Men hvad hvis du nu gerne vil sikre din adgang endu mere? og det kan du med Google Authenticator integrationen.

Forudsætning:

  • OS: Redhat/Fedora/CentOS/Rocky Linux/Oracle Linux/Cloudlinux. Disse har jeg det kørende på.
  • Kræver EPEL repository (yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm)
  • Jeg kan godt lide at benytte nano som tekst editor, men du kan naturligvis også benytte vi.

 

Installation af Google Authenticator:

  1. sudo yum install google-authenticator indtast y og tryk [enter] for at bekræfte.

Nu kan vi påbegynde konfiguration af Google Authenticator:

  1. google-authenticator efter du har kørt denne kommando, vil du blive spurgt om nogle spørgsmål.

Do you want authentication tokens to be time-based (y/n) y

[QR billede vil blive vist her, som du kan scanne med din mobil, i google authenticator app]

Hvis ikke du har libqrencode installeret, så får du fejl: “Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: XXXXXXXXXXXXXXXXXXXXXXXXXX <— denne Secret key skal du indtaste i din Google Authenticator under “Konto”.
Your verification code is XXXXX <— denne kode skal du indtaste i din Google Authenticator under “Nøgle”.
Your emergency scratch codes are: <— Gem disse koder hvis du en dag mister adgangen til google authenticator.
XXXXXXXXX
XXXXXXXXX
XXXXXXXXX
XXXXXXXXX
XXXXXXXXX

Do you want me to update your “/home/um/.google_authenticator” file? (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y

If the computer that you are logging into isn’t hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y

Nu kan vi påbegynde konfiguration af SSHD:

  1. nano /etc/pam.d/sshd scroll helt ned i bunden, og tilføj, og gem CTRL+X og Y:
    auth required pam_google_authenticator.so
  2. nano /etc/ssh/sshd_config og søg efter “ChallengeResponseAuthentication” CTRL+W og [Enter], ændre værdi til yes:
    ChallengeResponseAuthentication yes

Genstart SSHD service: service sshd restart

Nu kan du logge ind med alm. adgangskode og Google Authenticator nøgle. 

 

Skriv et svar

Din e-mailadresse vil ikke blive publiceret.