Two Factor Authentication on EC2

Question

I need to host stuff for a financial institution on EC2. The bank wants complete Two Factor Authentication so Stuff like having SSH with a key with password. Something like SecureID or similar would be great. How can I effectively create two factor authentication across SSH to my EC2 environment?

Also could I consider OpenVPN as part of the Two Factor encyption?

Answer 1

You will need to secure access to the EC2 console with two-factor. There you are at the mercy of Amazon. For SSH access, you can do lots of options. You can do SSH keys and require that the keys have a password. However, note that there is nothing to keep someone from writing an SSH client that lies about the cert having a password. SSH is great from a security PoV, but it doesn't always pass muster for regulatory requirements. For example, the keys might need to be re-generated periodically. SSH doesn't support that.

PAM radius is your friend if you decide to use a two-factor auth system: http://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to

hth,

Answer 2

Two-factor authentication similar to SecurID is readily available via AWS Identity and Access Management (IAM) by means of the AWS Multi-Factor Authentication. Whether this actually applies to your question depends on your particular use case though, i.e. what scenarios you need to protect with two-factor authentication (e.g. the mentioned SSH access vs. AWS Management Console access vs. access to websites you host on EC2 in return etc.).

Specifically, IAM covers access to the AWS Management Console but obviously not SSH, in addition EC2 is one of the AWS products, where IAM does not apply at the resource level, rather only at the service level, see Integrating with Other AWS Products and Using AWS Identity and Access Management with EC2, especially the following disclaimer:

Important

Amazon EC2 uses SSH keys, Windows passwords, and security groups to control who has access to specific Amazon EC2 instances. You can't use the IAM system to allow or deny access to a specific instance.

Please note that IAM usage is highly recommended for anything AWS regardless of multifactor-authentication.

Finally I'd like to highlight two more recent additions to IAM potentially helpful regarding your use case as well:

• AWS Identity and Access Management - Now With Identity Federation - This new capability allows existing identities (e.g. users) in your enterprise to access AWS APIs and resources using IAM's fine-grained access controls, without the need to create an IAM user for each identity.
• AWS Virtual (Software) Multi-Factor Authentication - RFC 6238 Support - We support hardware MFA devices, which you can purchase to generate your MFA authentication codes. [...] Today we are pleased to announce that we are introducing an additional option, the Virtual MFA device. You can now generate MFA authentication codes on your smartphone or tablet.

Answer 3

With duo_unix, you can add two-factor authentication for any SSH login method, and with the Duo OpenVPN integration, you can add two-factor authentication to OpenVPN.

Disclaimer, I work for Duo.

Answer 4

EC2 allows you to setup your machines with different SSH certificates that you can create, the easiest solution for you would be to just create one that requires a password.

Also be aware of the security limitations of EC2, the security is peripheral and you don't know which machines are doing what inside so place strict security to communicate between machines, some strong encryption VPN (OpenVPN or stunnel) is highly desired for this.