Changes between Version 4 and Version 5 of netsec2018ssh

Timestamp:

Jun 7, 2018, 7:10:53 AM (7 years ago)

Author:

admin

Comment:

--

netsec2018ssh

@@ -69 +69 @@
  - Click the Save button for the Load, Save or Delete a stored session area.
 Now you can go ahead and log in and you will not be prompted for a password. However, if you had set a passphrase on your public key, you will be asked to enter the passphrase at that time (and every time you log in, in the future).
+
+== Two Factor Authenticating ==
+We will enable two factor authentication in out ubuntu server. To implement that we are going to use multifactor authentication with Google Authenticator.
+
+=== Google auhtenticator ===
+ - Install Google Authenticator from following link in your Android device/iPhone/iPad/BlackBerry/Firefox devices
+{{{
+https://support.google.com/accounts/answer/1066447?hl=en
+}}}
+ - Follow the instruction and install the app in your mobile.
+ - Or you can search for google-autheticator in Google Play or Apple Store.
+
+=== Create an Authentication Key ===
+ - Go to the Ubuntu VM
+ - Install google-authenticator module first:
+{{{
+sudo apt-get update
+sudo apt-get install libpam-google-authenticator
+}}}
+ - Log in as the user you’ll be logging in with remotely and run the google-authenticator command to create a secret key for that user.
+{{{
+$ google-authenticator
+
+Do you want authentication tokens to be time-based (y/n) y
+}}}
+ - You will get some QR code ouput like bellow:
+
+
+You will be prompted for some configurations.
+ - Scan the QRcode that appears with the Google Authenticator app or you can add the secret key Google Authenticator app.
+ - Save the backup codes listed somewhere safe. They will allow you to regain access if you lose your phone with the Authenticator app.
+ - Next it will ask several question; unless you have a good reason to, the defaults presented are sane. Just enter "y" for them.
+{{{
+Do you want me to update your "/home/fakrul/.google_authenticator" file (y/n)
+Do you want to disallow multiple uses of the same authentication
+token? This restricts you to one login about every 30s, but it increases
+your chances to notice or even prevent man-in-the-middle attacks (y/n)
+By default, tokens are good for 30 seconds and in order to compensate for
+possible time-skew between the client and the server, we allow an extra
+token before and after the current time. If you experience problems with poor
+time synchronization, you can increase the window from its default
+size of 1:30min to about 4min. Do you want to do so (y/n)
+If the computer that you are logging into isn't hardened against brute-force
+login attempts, you can enable rate-limiting for the authentication module.
+By default, this limits attackers to no more than 3 login attempts every 30s.
+Do you want to enable rate-limiting (y/n)
+}}}
+
+=== Enable two factor authentication for SSH ===
+ - Edit the /etc/pam.d/sshd file
+{{{
+sudo vi /etc/pam.d/sshd
+}}}
+ - Add the following line:
+{{{
+auth required pam_google_authenticator.so
+}}}
+ - ''':wq''' Save and quit.
+ - Edit /etc/ssh/sshd_config file
+{{{
+sudo vi /etc/ssh/sshd_config
+}}}
+ - Search for '''ChallengeResponseAuthentication''' and replace no with yes
+{{{
+ChallengeResponseAuthentication yes
+}}}
+ - ''':wq''' Save and quit.
+ - Now you need to reload the ssh service. You can do it to way:
+{{{
+sudo service ssh restart
+}}}
+
+=== Login to the server ===
+Try to ssh to the server from a new terminal. It will ask for the verification code.