Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With the introduction of Google Authenticator and the ability to use it with ssh I was wondering if someone has gone through a sshd_config setup which would

  • first expect a key
  • if this fails, fall back to an authentication with Google Authenticator

The idea being to usually connect seamlessly with a key and, usually in less friendly environments, connect with a two factor mechanism.

share|improve this question
add comment

migrated from superuser.com Nov 4 '11 at 21:16

This question came from our site for computer enthusiasts and power users.

1 Answer

up vote 11 down vote accepted

Yes, I have a setup where I can ssh to my server using public key authentication, with a fallback to two-factor authentication with Google Authenticator + password when my private key is not available. These are the steps you can use to set it up.

Installing Prerequisites

My server is running Ubuntu Precise Pangolin (12.04.2). If you don't already have git installed, you will need it to clone the Google Authenticator repository. There are a few other dependencies you need to compile and install Google Authenticator as well.

$ sudo aptitude install git gcc libpam0g-dev make

Downloading and Installing Google Authenticator

Now you are ready to download Google Authenticator and install it on your server.

$ git clone https://code.google.com/p/google-authenticator/
$ cd google-authenticator/libpam/
$ make
$ sudo make install

Configuring sshd

Open /etc/pam.d/sshd and add the following line at the top:

auth optional pam_google_authenticator.so

Open /etc/ssh/sshd_config and change one line. The existing line is

ChallengeResponseAuthentication no

and you should change it to

ChallengeResponseAuthentication yes

Configuring Google Authenticator for Your Account

The next step is to turn on Google Authenticator for your account. You do this by simply running:

$ google-authenticator

Make sure you run this as the user who will be making ssh connections, not root. Make a note of your new secret key and your emergency scratch codes. The wizard will ask you several questions to configure the security settings for your account.

Configuring Your Mobile App

I use the Google Authenticator app for iPhone. This app has a [+] button that allows me to add a new Time Based Token using the secret key I obtained from the google-authenticator command on my server. It was trivial to set up. I can't help you with apps on any other platform, but I imagine the process is equally simple.

Pulling the Trigger

The last thing you need to do is restart sshd.

$ sudo /etc/init.d/ssh restart

At this point, when you try to connect to the server when your private key is available, authentication just works. When your private key is not available, you will get a prompt for a verification code, then your account password.

Bingo, two-factor authentication.

share|improve this answer
    
Thanks a lot - this is very complete and exactly what I was looking for. –  WoJ Nov 5 '11 at 7:34
    
Looks great, exactly what I need. I'll follow ur instructions and give feedback afterwards. –  peipst9lker Aug 16 '13 at 9:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.