Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [google-authenticator]

Google Authenticator is a TOTP (Time based One Time Password) PAM (Pluggable Authentication Module) which is supported and serviced by Google.

0
votes
0answers
2 views

Seeking solution to protect both Confluence and Jira with Google Authenticator 2FA

I want to be able to protect our on-premise Jira and Confluence installs with Google Authenticator for 2 factor authentication. I figured this would be simple. I Googled, and I searched on the ...
0
votes
0answers
645 views

Is using HOTP only authorization considered weak?

I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for casual ...
2
votes
1answer
213 views

Require SSH key + Google Authenticator for one account, SSH key only for another

I am trying to setup an SSH authentication structure, but I'm struggling with issues in /etc/ssh/sshd_config vs /etc/pam.d/sshd. Requirements: Accounts with root/sudo privileges require public key ...
1
vote
1answer
345 views

Ubuntu-18.04 and libpam-google-authenticator not prompting for keyboard-interactive

On a new Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-1017-aws x86_64), I have installed Google Authenticator [1] and configured it in the following way /etc/pam.d/sshd #@include common-auth ... auth ...
3
votes
0answers
567 views

OpenVPN 2.4 + Google Authenticator = authentication failure

We have a corporate VPN server running OpenVPN 2.3 on an AWS instance with Ubuntu 16.04 Xenial. The server has been configured using an Ansible playbook. I'm planning to upgrade to Ubuntu 18.04 ...
1
vote
1answer
31 views

Access of users using google-authenicator without token

I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
0
votes
0answers
76 views

Is the configuration I want possible? Problems with SSH to Redhat server using google authentication 2fa

I'm attempting to configure two factor authentication when using SSH to connect to my redhat ec2 instance. I would like to configure it like this: If user has both ssh key and google auth set up, ...
0
votes
0answers
30 views

How to use 2FA with cert based SSH auth?

I used this guide to enable Google TOTP auth on Ubuntu 16.04. SSH only allows cert based auth (PasswordAuthentication no) I set ChallengeResponseAuthentication yes and restarted the SSH service. I ...
1
vote
1answer
98 views

OpenVPN MFA without unix users

Have you guys have an idea is it possible to configure OpenVPN with pam_google_authenticator.so with no need to authenticate using username/password but only cert + TOTP? I don't want to create a new ...
0
votes
0answers
516 views

OpenVPN + Google Authenticator MFA

I'm currently using the following OpenVPN: https://github.com/Nyr/openvpn-install What's the best way to enable MFA with Google Authenticator? I'm currently using the following server config at /...
0
votes
0answers
25 views

Multi-Factor Authentication varieties and is there a universal bridge for them

I am trying to research a project on how to connect to multiple enterprise environments that employ multi-factor authentication using a singular approach. My question is, are there any systems out ...
1
vote
0answers
216 views

Google authenticator on Windows

I need to setup Google Authenticator on MS Windows server to implement 2-factor authentication for a web application. Which server software is the best to use for this purpose?
0
votes
1answer
632 views

RHEL 7 google-authenticator publickey only with optional MFA

I am trying to setup MFA on RHEL 7 and running into a chicken and egg problem. If I enable MFA in pam you can't login to setup your .google-authenticator file. I understand that the nullok option in ...
1
vote
3answers
1k views

Google-authenticator with openvpn - AUTH: Received control message: AUTH_FAILED

I'm trying to set up MFA with Google authenticator for my OpenVPN setup on Ubuntu 16.04. Now OpenVPN works fine until I bring Google Authenticator into the mix. My server.conf file reads as follows: ...
0
votes
1answer
731 views

Google Authenticator PAM on SSH blocks root login without 2FA

Situation: I have activated Google Authenticator 2FA for SSH logins on Ubuntu 16.04 but made it optional in the /etc/pam.d/sshd: auth required pam_google_authenticator.so nullok I have setup the ...
0
votes
0answers
1k views

Google Authenticator on Nginx

I built Nginx with ngx_http_auth_pam_module and edited Nginx configurations and /etc/pam.d/nginx like this Part of virtual host setting location / { root /projects/admin; index index.html ...
2
votes
1answer
843 views

Google Authenticator FreeRADIUS

I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7. I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth The reason I say ...
0
votes
1answer
30 views

Google authenticator QR code scan work in any mobile

I'm using google authenticator code for 2FA in my website. Can able to check QR code is scanned from registered mobile number? Now, i can able to scan the code from any mobile
0
votes
1answer
77 views

PAM Ignore Password Prompt Upon Successful Login

I have a CentOS 7 server that uses key based authentication for login, along with using Google Authenticator for two-factor authentication. I am wishing to set it up, so that upon a successful login (...
1
vote
1answer
1k views

Tacacs+ with PAM two-factor Google authentication?

I'm working on a tacacs+ server for my campus network, and I have been wondering how I could set up a tacacs+ server to communicate to PAM running google's two-factor authentication. I've done quite a ...
1
vote
1answer
75 views

Logout user if they break a bashrc command

I'm running a small script when a user accesses my Linux host via SSH. This script should verify and/or set up Google Authenticator MFA access for the user. Right now it works as intended with one ...
0
votes
2answers
2k views

How to automate google-authenticator MFA configuration for SSH access

At my company we currently have a SSH jump server of sorts, through which our workers access our clients' server endpoints. We have setup a couple of Ansible playbooks that essentially create/remove/...
1
vote
1answer
2k views

SSH Google Authenticator Ignore/Whitelist ips

I installed google authenticator (two step verification), "libpam-google-authenticator" package, although it asks for a code for every single connection to SSH. I want to put localhost and my own ip ...
6
votes
1answer
242 views

How to set-up google-authenticator and set specific match rules to allow different login rules?

I'm trying to set Google-Authenticator (google 2 factor authentication). The relevant files are: [root@srv01 ~]# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_google_authenticator.so auth ...
0
votes
1answer
239 views

Server allows logging in without supplying a password and no ssh keys were exchanged, what could be the reason?

I'm trying to secure an outbound server with Google 2FA solution. For the time being, I'm first configuring everything on a local Vagrant machine and once everything works as intended I'll run it as ...
1
vote
2answers
2k views

How to configure pam sshd to allow different rules on different users/groups?

I'm configuring google two-factor authentication on an outbound server in the company I work for. Here are the relevant configurations: /etc/ssh/sshd_config: ubuntu@stage-itai-1:~$ egrep -v '^#' /...
0
votes
1answer
98 views

Google-2fa: How to recover an account when emergency codes are not available? [closed]

There's a server in my company which is configured with Google two-factor authentication. A user from the company has lost his phone and can't find his emergency codes. What can be done in order to ...
1
vote
1answer
62 views

What is the right way to back up google authenticator emergency keys?

I'm implementing Google 2-Factor Authentication on some servers in my company. When configuring Google 2FA on client computers, 5 emergency codes are generated to be used if a user forgets his master ...
1
vote
0answers
636 views

MS Active Directory with Google Authenticator

I am currently designing our new internal IT services, including IAM and e-mail. We currently use more or less no IAM or single sign-on solution. We have a WordPress based website, postfix + dovecot ...
5
votes
2answers
76 views

industry standards for using google-authenticator with linux users?

Would like to ask, particularly those who run large environments with lots of users, if there are any standardized- or industry-recommended ways to securely distribute the verification codes to remote ...
0
votes
1answer
81 views

How to enable Google Authenticator over sshd when already using public key?

I'm running Debian Jessie on a VPS. I want to enable both private key and Google Authenticator to get into the server via SSH. I enabled auth required pam_google_authenticator.so in ...
10
votes
1answer
6k views

How to enable 2-factor auth using Google Authenticator for .ovpn file based openVPN access?

I have an openVPN setup where the users do not have shell accounts on the Debian VM running openVPN. The articles I found while Googling all have instructions of setting up Google Authenticator for a ...
1
vote
1answer
2k views

SSH Authentication using RADIUS + Google Authenticator

I'm trying configure my SSHD's to authenticate users using FreeRadius. The FreeRadius server needs to first require a valid OTP using Google Authenticator, and then verify the system account password. ...
1
vote
0answers
470 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...
0
votes
1answer
2k views

google-authenticator for two-factor-authentication support with openvpn client on linux

I am trying to get openvpn client to work with google-authenticator and two-factor-authentication. I cannot alter the server in any way (i.e. I cannot do password/token concactenation via pam mods, ...
0
votes
0answers
102 views

Public key authentication plus challenge authentication

I am trying to setup 2-phase authentication based on this guide, but instead of entering the password I would like public key to be involved. If PubkeyAuthentication yes in /etc/ssh/sshd_conf then 2 ...
1
vote
1answer
1k views

Google Authenticator - generate new set of emergency codes

I use Google Authenticator on my SSH servers with Andoid app for generating codes. After I run $ google-authenticator application create set of emergyncy keys: https://www.google.com/chart?chs=...
19
votes
3answers
18k views

Trying to get SSH with public key (no password) + google authenticator working on Ubuntu 14.04.1

I'm using Ubuntu 14.04.1 (with OpenSSH 6.6 and libpam-google-authenticator 20130529-2). I'm trying to set up SSH logins where the public key authenticates (without a password) and a user is prompted ...
1
vote
0answers
358 views

FreeRadius-GoogleAuthenticator-Kerberos Password Change Weirdness

We are using FreeRadius, Kerberos and Google Authenticator to implement two-factor authentication. The two factor auth works fine, both from radtest and from a Watchguard firewall. To log in, a user ...
3
votes
2answers
3k views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
0
votes
2answers
2k views

How do I create a custom ADFS 2nd factor sign in page?

I have a C# dll that provides HOTP and TOTP authentication. I'd like to adapt this for use with ADFS sign in pages. (I'll share this DLL with you if you like) How do I integrate my authentication ...
2
votes
1answer
713 views

Git github not working with google authenticator OSX

So I had git running on my computer just fine. My password was saved with the osxkeychain thingy and everything ran smoothly. Today I decided I should be safe and enable google authenticator 2-step ...
6
votes
1answer
1k views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
1
vote
1answer
2k views

possible? radius server with active directory users and google authentication

We currently have an old RSA token - Radius environment we want to replace Would this architecture be possible? (this works, there are examples on the internet) Linux server Google Authentication ...
0
votes
2answers
2k views

Whitelist IP from google-authenticator in sshd pam

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code. The /...
5
votes
2answers
4k views

Google authenticator with Openldap or Fedora 389 Server or FreeIPA

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
1
vote
3answers
956 views

Using Google Authenticator with an IMAP server

Google released it's Google Authenticator Module with a PAM interface. Have someone experience on implementing this into an imap server?
8
votes
1answer
1k views

ssh with passphrase, fallback to Google Authenticator

With the introduction of Google Authenticator and the ability to use it with ssh I was wondering if someone has gone through a sshd_config setup which would first expect a key if this fails, fall ...
2
votes
2answers
2k views

Google Authenticator PAM for specific users

My current sshd PAM config: #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session ...