Two Factor authentication (2FA) provides an extra layer of security to logins.
There are a number of forms of two factor authentication, for example:
- biometric – for example finger print readers
- SMS
- voice recognition
- key fob code generators
- software code generators
Two Factor authentication (2FA) is generally recommended :
- 2FA improves the security, adding another variable authentication option to the login.
- utilises a secondary device making it less likely that all the pieces to gain an attempt at logging in will be available.
Google provides a code generator app available on Android devices. This can be used against website logins and server logins.
We shall be adding two factor authentication to the SSH login of a Linux computer.
Google offers a package for Linux which works with their Google Authenticator app.
For the implementation of 2 factor authentication Google’s offering will be used. A supporting package is available in the Debian repositories.
Don’t logout of your configuration terminal until you have confirmed that you are able to login successfully and consistently from a second terminal.
Installation
For those at ease with the terminal
apt install libpam-google-authenticator
Configuration
Don’t forget this is for all users.
Edit the file /etc/pam.d/sshd adding the line
auth required pam_google_authenticator.so
To configure the SSH Server, in the file
/etc/ssh/sshd_config
amend this line to yes
ChallengeResponseAuthentication yes
Restart the ssh server to take up the change in configuration.
service sshd restart
Configure Google Authenticator
For each user run the command google-authenticator to answer the questions.
Make your choices for the questions.
A QR code is shown. The Google 2fa app scans this code to make its setup.
Also shown are other values these are:
- secret key
- 5No. emergency scratch codes
Ensure that you keep a note of these safely.
Confirmation
Don’t logout just yet!
To confirm that the installation has proceeded correctly try to login using another terminal session.
Note the given code has a space for readability. Ignore this when entering the code.
If all is well then you will be able to logout and return when desired.
Accessing From Another Phone
The QR code was copied and moved on how to add it to another phone?
how to access from a second device?
the action is taken on Google’s authenticator on the phone/device.
In top right corner of the app click on the 3 dots (menu), select transfer accounts from the popup menu
On the next screen select export accounts
There’s a confirmation of accessibility
On the next page is shown a list of the accounts. Ensure only the account to be copied across is ticked.
Click next to view a QR code for the account. This can be scanned just like when you added it to your phone.
Removal
Actions to take to remove two factor authentication:
Where possible either change a value or comment the line to make it easier to reinstate should you change your mind.
- Change the ChallengeResponseAuthentication value from yes to no in the file /etc/ssh/sshd_config.
- Comment the line auth required pam_google_authenticator.so in the file /etc/pam.d/sshd
- For each user remove the .google_authenticator file from their home directory
- Restart the ssh service systemctl restart ssl
Try logging in once more using a different terminal, just to be sure that all is well. Don’t wish to close the existing terminal connection and find later that its not possible to connect!
Problems
Accessing samba directories
Does this prevent Samba directory access? Yes. Consider whether you wish to apply this to a Samba server.
Unable to Login
Initially unable to login could enter password and then verification code but subsequently repeated requests for password and verification code until ultimately disconnected due to too many failed login attempts
Did you run the Google authenticator under the right user?
