I have dedicated Ubuntu server in the Internet so I want to:

  1. Connect to my server via HTTP(s)
  2. Input password and MFA token (i.e. Google Authenticator token)
  3. If both are correct, server executes iptables rule that temporary opens some ports to IP i've authenticated from

What is the best/easiest way to implement that?

Why not libpam-google-authenticator + ssh:

  • I do not want to expose ssh port by default. I use key-based auth but nevertheless.
  • I want to run automation scripts from my machine w/o entering MFA token every time
  • I want to work from Windows using Cygwin ssh
  • Can you elaborate on why an exposed HTTPS server is ok but ssh is not? – Alex Holst Nov 3 '15 at 18:54
  • @AlexHolst because breaching of specialized HTTPS server means little exposure while breaching of sshd which runs as root and used to gain access to host... – Sergey Alaev Nov 3 '15 at 21:01
  • You must run very different httpd and sshd servers than the rest of the world. Sorry I can't be of much assistance. – Alex Holst Nov 4 '15 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.