If you run servers that are accessible from the internet, you might have noticed the many many brute-force login attempts to random accounts against your system. While the risk, that one of these brute-force attempts succeeds is very low (if you chose decent passwords), one might come to the conclusion, that simple user- and password authentication is not safe enough for complete peace of mind.
Here is where two-factor auth comes to play. Until now, there were not so much options if you didn’t want to spend any money. Here is where Google Authenticator comes in handy: It makes two-factor auth accessible for the greater public.
It consists of two components:
- An app for your smartphone, that spits out verification codes
- A PAM module for you linux box, to validate the verification codes
In this article, I will explain how to get and install the Google auth PAM module for Linux.
First, you have to prepare a build environment by fetching all needed development packages:
root@srv /home/me # apt-get install make libpam0g-dev
...
The following NEW packages will be installed:
binutils cpp cpp-4.4 gcc gcc-4.4 libc-dev-bin libc6-dev libgmp3c2 libgomp1 libmpfr4 libpam0g-dev
linux-libc-dev make manpages-dev
...
Then, go and grab the source of the Google Authenticator PAM module from http://code.google.com/p/google-authenticator/downloads/list.
After you got the sources and extracted them from the tarball, you can continue with building the module:
root@srv /home/me # cd libpam-google-authenticator-1.0
root@srv /home/me/libpam-google-authenticator-1.0 # make
...
root@srv /home/me/libpam-google-authenticator-1.0 # make install
Install the module and setup PAM to use it for SSH logins:
cp pam_google_authenticator.so /lib/security
cp google-authenticator /usr/local/bin
vim /etc/pam.d/sshd
...
auth required pam_google_authenticator.so
...
Setup SSHD to ask for the verification codes:
vim /etc/ssh/sshd_config
...
ChallengeResponseAuthentication yes
...
Setup the module:
root@srv /home/me/libpam-google-authenticator-1.0 # su me
me@srv:~/libpam-google-authenticator-1.0$ /usr/local/bin/google-authenticator
Do you want authentication tokens to be time-based (y/n) y
...
Your new secret key is: ...
Your verification code is ...
Your emergency scratch codes are:
...
Do you want me to update your "/home/me/.google_authenticator" file (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y
After you did everything correctly, you can try to login via SSH and the system should ask you for your verification code:
login as: me
Using keyboard-interactive authentication.
Verification code:
Using keyboard-interactive authentication.
Password:
To round up your setup, you should not forget to remove the packages you installed to build the Google Authenticator module:
root@srv /home/me/libpam-google-authenticator-1.0 # apt-get autoremove make libpam0g-dev