1

I am a newbie when it comes to Two factor authentication. I have the general idea of implementing two factor authentication on a single server. But I was wondering if there is a standard solution for implementing it on multiple servers.

SCENARIO:

So, there a bunch of *nix machines (around 50) for which I want to enable two factor authentication. If I enable 2 factor ssh authentication using google authenticator (https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication) on all machines, it doesn't seem like a good idea to generate and keep track of individual auth codes. Is there any way I can simplify the whole process.

EX:
Is there a way I can use two factor ssh authentication once and forward it with my ssh requests to all machines? Like a proxy machine which can handle OAuth for rest of my stack? Also are there existing systems/softwares/services in place which, can make the implementation easier? I am open to new architectural designs as well.

Thanks in advance!

PS:
We are currently using ssh-key based authentication on all our machines

2
  • You write "use two factor ssh authentication once and forward it with my ssh requests to all machines" - but the core concept of two-factor authentication is that the data from the hardware token is usable only once, or if reusable, only for a very short period. So even if you could do this, it would be pointless - if it worked, it wouldn't be true two-factor authentication. Mary's suggestion is probably your best bet - have two-factor authentication to the only machine that's generally accessible, then use ssh key-based authentication, and ssh-agent on the clients, from then on in.
    – MadHatter
    Aug 4 '15 at 12:47
  • What you are trying to achieve in a pure security perspective is to install a second lock on your doors so you can open wide all your windows. So with that in mind, I think that project would be better justified if the reasoning was to ease the operation's burden, not to increase security.
    – Alex
    Aug 4 '15 at 14:34
1

If your primary goal is to authenticate once and have access to all your machines without having to re-authenticate, you could use hostkey-based authentication from your jump-off host: https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server.

(Apologies if you already knew about this option.)

2
  • Hi Mary, Thanks for replying; we are already using ssh-key based authentication as you said. We wanted to keep the same flow albeit factoring in more security by using two factor over ssh.
    – MaK
    Aug 4 '15 at 12:26
  • Oh, sorry, misunderstood the objective there. Actually, you can do key+password authentication two ways: one is to put a passphrase on your local key store. The other is to require both a key and a password for the server connection (available since 6.2): sysconfig.org.uk/two-factor-authentication-with-ssh.html
    – Mary
    Aug 5 '15 at 13:52
0

If you have isolated network (no one can use your subnet), you can disable public SSH access for all machines (let us call these as private machines) except one/two machines (public machines).

The public machines have two factor authentication.

The private machines don't have two factor authentication. The private machines SSH port is only accessible from a certain IP (your subnet for example, or public machines IP).

This way is usually people do in AWS environment with public-private subnet. Instances with only private IP only accessible from instances which have public access.

So, whenever you want to access your private machines, you need to login to a public machine first. And then, from there, you can login to any machines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.