Comments (5)
Humm. What distribution are you on? I do not recall having this issue.
from how-to-secure-a-linux-server.
In my case the 2FA doesn't work. SSH just skips that part entirely.
Basically, I type in ssh user@host
, I enter my password and it drops me into the shell instantly without asking me for a 2FA code. The suggestions by @B1ack3ye don't help in my case. My /etc/ssh/sshd_config
is the exact same as described in the README and I also added that line into the PAM config. Is it maybe because the request comes from the inside of the network?
Distro: Ubuntu 22.04 (Desktop version, inside VM)
from how-to-secure-a-linux-server.
Same. The configurations allow me to connect without 2FA.
If I add the line AuthenticationMethods publickey,keyboard-interactive
then the issue is that the 2FA code does not work, the code is right, I left the flexible settings on the authenticator, but codes don't work.
from how-to-secure-a-linux-server.
As stated in the guide, the steps don't set up MFA to work with public key authentication.
However, the guide states that in the 'documentation' it should be specified, this is not the case:
there is no information about setting up 2FA/MFA with public key authentication, neither on the repo nor in the manual.
My opinion is that, since we're setting up SSH to only use public key authentication, this setup should a) be provided as alternative steps, or b) not provided.
from how-to-secure-a-linux-server.
Steps For Public Key + TOTP MFA
Modify PAM's SSH configuration file to enable MFA
Add the following line to /etc/pam.d/sshd
:
auth required pam_google_authenticator.so nullok
This line states that MFA is required for SSH login,
unless MFA has not been set up yet for the user.
Comment out the following lines in /etc/pam.d/sshd
:
# We only want PAM to handle MFA, not password auth
# Standard Un*x authentication.
# @include common-auth
# As stated before, PAM will not handle password auth
# Standard Un*x password updating.
# @include common-password
Modify sshd_config to enable MFA
Add the following line to /etc/ssh/sshd_config
:
# Explicitly set public key authentication
PubkeyAuthentication yes
# Activate keyboard authentication to be able to enter our TOTP
KbdInteractiveAuthentication yes
# Set authentication methods
AuthenticationMethods publickey,keyboard-interactive:pam
# Activate PAM to be able to use google auth pam module
UsePAM yes
Restart the SSH service
sudo systemctl restart sshd
This configuration will require us to have a private key,
and a TOTP MFA code.
from how-to-secure-a-linux-server.
Related Issues (20)
- Translate into Mandarin HOT 2
- SSH options HOT 2
- psad fails to update signatures HOT 1
- Implementing Post‑quantum Cryptography
- Gmail SMTP: You can no longer use the account's password HOT 2
- exim4 Gmail - TLS connection errors / "Authentication Required" HOT 3
- SSH keypair not able to login with passpharase HOT 1
- Fail2ban fails on fresh Debian12
- Disabling bash history on root account? HOT 3
- HashKnownHosts set to yes HOT 5
- psad missing ufw log setting
- sshd_config compression option no longer a security risk HOT 1
- sshd_config protocol 1 support completely removed resulting in protocol option being removed
- [Ubuntu 24.04] Error: fail2ban [5004]: ERROR No module named 'asynchat'
- Version this guide and create tags
- Ubuntu Guide is Unreachable HOT 1
- Suggestion: UFW Firewall for Cloudflare
- Please add Postgres section HOT 2
- Conflicting statements on CIS benchmarks HOT 1
- A dead article. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from how-to-secure-a-linux-server.