From 797a1404213173791a5f4126a77ad383ceb00064 Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Mon, 4 Mar 2024 22:34:28 -0600 Subject: initial migration to test org-mode --- blog/ssh-mfa/index.org | 189 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 189 insertions(+) create mode 100644 blog/ssh-mfa/index.org (limited to 'blog/ssh-mfa/index.org') diff --git a/blog/ssh-mfa/index.org b/blog/ssh-mfa/index.org new file mode 100644 index 0000000..85b98de --- /dev/null +++ b/blog/ssh-mfa/index.org @@ -0,0 +1,189 @@ +#+title: Enable TOTP MFA for SSH +#+date: 2022-03-26 +#+description: Learn how to enable timed one-time passcodes for SSH. +#+filetags: :security: + +* Why Do I Need MFA for SSH? +If you are a sysadmin of a server anywhere (that includes at home!), you +may want an added layer of protection against intruders. This is not a +replacement for other security measures, such as: + +- Disable root SSH +- Disable SSH password authentication +- Allow only certain users to login via SSH +- Allow SSH only from certain IPs + +However, MFA can be added as an additional security measure to ensure +that your server is protected. This is especially important if you need +to allow password authentication for SSH. + +For more guidance on server security measures, see my other post: +[[../hardening-a-public-facing-home-server/][Hardening a +Public-Facing Home Server]]. + +* Install MFA PAM Module +PAM, which stands for Pluggable Authentication Module, is an +authentication infrastructure used on Linux systems to authenticate a +user. In order to use this technology, let's install the +=libpam-google-authenticator= package: + +#+begin_src sh +sudo apt-get update +#+end_src + +#+begin_src sh +sudo apt-get install libpam-google-authenticator +#+end_src + +* Initialize the PAM Module +** Interactive Method +Once the package is installed, initialize it and following the +interactive prompts to generate your OTP or TOTP: + +#+begin_src sh +google-authenticator +#+end_src + +If you are not sure how to answer, read the prompts carefully and think +about having to how each situation would affect your normal login +attempts. If you are still not sure, use my default responses below. + +#+begin_src txt +OUTPUT + +Do you want authentication tokens to be time-based (y/n) y +#+end_src + +At this point, use an authenticator app somewhere one of your devices to +scan the QR code. Any future login attempts after our upcoming +configuration changes will require that TOTP. + +#+begin_src txt +OUTPUT + +Do you want me to update your "/home/user/.google_authenticator" file? (y/n) y +#+end_src + +#+begin_src txt +OUTPUT + +Do you want to disallow multiple uses of the same authentication +token? This restricts you to one login about every 30s, but it increases +your chances to notice or even prevent man-in-the-middle attacks (y/n) y +#+end_src + +#+begin_src txt +OUTPUT + +By default, a new token is generated every 30 seconds by the mobile app. +In order to compensate for possible time-skew between the client and the server, +we allow an extra token before and after the current time. This allows for a +time skew of up to 30 seconds between authentication server and client. If you +experience problems with poor time synchronization, you can increase the window +from its default size of 3 permitted codes (one previous code, the current +code, the next code) to 17 permitted codes (the 8 previous codes, the current +code, and the 8 next codes). This will permit for a time skew of up to 4 minutes +between client and server. +Do you want to do so? (y/n) n +#+end_src + +#+begin_src txt +OUTPUT + +If the computer that you are logging into isn't hardened against brute-force +login attempts, you can enable rate-limiting for the authentication module. +By default, this limits attackers to no more than 3 login attempts every 30s. +Do you want to enable rate-limiting? (y/n) y +#+end_src + +** Non-Interactive Method +If you need to do this quickly, know your responses to the prompts, or +are setting this up for numerous users, the non-interactive method can +be much faster: + +#+begin_src sh +google-authenticator -t -d -f -r 3 -R 30 -w 3 +#+end_src + +The options referenced above are as follows: + +#+begin_src txt +google-authenticator [] + -h, --help Print this message + -c, --counter-based Set up counter-based (HOTP) verification + -t, --time-based Set up time-based (TOTP) verification + -d, --disallow-reuse Disallow reuse of previously used TOTP tokens + -D, --allow-reuse Allow reuse of previously used TOTP tokens + -f, --force Write file without first confirming with user + -l, --label=