14

I have an Ubuntu server with both a private, internal, IP and a public-facing IP. I want to set up two-factor authentication for SSH on just the public side. Is this possible? I was planning on using Google Authenticator, but am open to alternative ideas as well.

1

2 Answers 2

17

Yes, you can do this with pam_access.so. This recipe was taken from the wiki for the Google Authenticator:

A useful PAM recipe is to allow skipping two-factor authentication when the connection originates from certain sources. This is already supported by PAM. For example, the pam_access module can be used to check the source against local subnets:

# skip one-time password if logging in from the local network
auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth       required     pam_google_authenticator.so

In this case, access-local.conf looks like:

# only allow from local IP range
+ : ALL : 10.0.0.0/24
+ : ALL : LOCAL
- : ALL : ALL

Thus login attempts from 10.0.0.0/24 will not require two-factor authentication.

1
  • 1
    That's exactly what I was looking for. Not sure why I didn't see it earlier. Thanks!
    – Brett F.
    Jun 26, 2013 at 17:56
2

My requirement was very similar, but more specifically i wanted to 1) have pubkey AND googleAuth from outside and 2) have pubkey OR password from inside (password in case i lose all my pubkeys):

/etc/ssh/sshd_config:

AuthenticationMethods publickey,keyboard-interactive
Match address 192.168.2.0/24
    PasswordAuthentication yes
    AuthenticationMethods "password" "publickey"
Match all

/etc/pam.d/sshd:

# Google Authenticator
auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth sufficient pam_google_authenticator.so

# Standard Un*x authentication.
auth [success=ignore default=4] pam_access.so accessfile=/etc/security/access-local.conf
@include common-auth

/etc/security/access-local.conf

+ : ALL : 192.168.2.0/24
- : ALL : ALL

Additionally to previous answer i had to skip the 4 rules inside /etc/pam.d/common-auth when from outside, also i configured google auth to sufficient instead of required. I did this on Ubuntu 20.04, but this solution should be quite generic

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.