Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over SSH. However, when logging in from an untrusted machine there's always the risk of a keylogger capturing my login password as I type it.

FreeBSD already has support for OPIE which is a one-time password scheme. This works great, but the one-time password is the only authentication needed. If I print out a list of one-time passwords to use later, then if I lose that list then that's all somebody needs.

I'd like to set up the authentication so that I need a one-time password plus something I know (a password, except not my usual login password). I have a feeling the answer has something to do with PAM (and /etc/pam.d/sshd) but I'm not certain on the details.

How can I set up authentication where two methods are required?

share|improve this question
    
If you lost the list of OTPs, wouldn't you know this and change your opie password? –  Chris S Aug 26 '10 at 20:33
    
@Chris S: that assumes you can log in to the server from wherever you are without having your OTP list. –  Greg Hewgill Aug 26 '10 at 20:45
    
Considering OPIE hasn't been updated in almost 16 years, I'm sure it was an oversight at the time; I don't know of a way to do what you're asking, but it definitely sounds like a really good idea that should be implemented. My smart@ss answer to being able to login from almost everywhere: consider getting a smart phone with PocketPutty or a similar app. –  Chris S Aug 26 '10 at 20:55
add comment

3 Answers 3

To do this you have to stack the normal ’ssh_auth’ module with the ‘pam_opie‘ module using the ‘required‘ control flag.

share|improve this answer
1  
That would expose his actual password; the question specifically said "except not my usual login password" –  Chris S Sep 10 '10 at 3:59
    
Ah, I missed that! Then he needs a pam module which uses a static second password with ssh-kbdint. Unfortunately I don't know of anyone who has written such a module, but it isn't very hard as you can use ssh_auth and modify it to use another password file. –  Martin Sep 11 '10 at 4:52
add comment

google authenticator maybe? I have my OpenSolaris box asking first for normal login password, then the TOTP verification code. Something like this: http://www.marzocchi.net/Olafsen/Software/Two-FactorAuthentication

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.