Linux Secure SSH - Two step verification

[Szafi]

Hello.
How to create two step ssh authentication in your dedicated Server or VPS.

​

Lets go!​

cd /root

apt-get update

apt-get upgrade

apt-get install libpam0g-dev make wget

cd /root

wget https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2

tar -xvf libpam-google-authenticator-1.0-source.tar.bz2

cd libpam-google-authenticator-1.0

make

make install

nano /etc/pam.d/sshd

add on end line

auth required pam_google_authenticator.so

save file and

nano /etc/ssh/sshd_config

next search

ChallengeResponseAuthentication no

and change to

ChallengeResponseAuthentication yes

/etc/init.d/ssh restart

How to config?
run

google-authenticator

and ansfer on more questions.

If you have answered all questions program print example message:

Do you want authentication tokens to be time-based (y/n) y
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@twojhost%3Fsecret%3DTEST
Your new secret key is: SEKRETNY KLUCZ
Your verification code is KOD WERYFIKACYJNY
Your emergency scratch codes are:
123
456
789
123
123
423

Next download on Apple Store or Google Play program "Google Authenticator":
Android: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2
Apple Store: https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8

If you install program on telephone please scan code (look up "example message" line number 2 paste url adress in web Browser)

(IOS 8.x)

End If tou have more user's on serwer please login to user use command: su user (example "su theforgottenserver") and run

google-authenticator

to configure key on theforgottenserver user. You will have to re-answer questions and scan new QR code to theforgottenserver user.

DONE!

This is my first tutorial and im from Poland. Sorry for my weak language. Please comment, rate and .... more :x

Szafi (Old Sessam).

 

[dominique120]

Nice tutorial!

However it looks like your screwed if you dont have one of those new fancy smart phones unless there is some alternative.

 

[averatec]

private ssh key + port knocking

 

[Szafi]

Nice tutorial!

However it looks like your screwed if you dont have one of those new fancy smart phones unless there is some alternative.

Alternative for "google-authenticator" is sending SMS to your telephone number. Message contains a random code to login on your serwer but you pay for each sms. I have SMS solution if password is wrong. Serwer send SMS: IP adress and more information that the user entered the wrong data.

private ssh key + port knocking

Yes

 

[Mark]

As of Debian 8 (jessie), you can install it using:
apt-get install libpam-google-authenticator

 

[averatec]

Alternative for "google-authenticator" is sending SMS to your telephone number. Message contains a random code to login on your serwer but you pay for each sms. I have SMS solution if password is wrong. Serwer send SMS: IP adress and more information that the user entered the wrong data.


Yes

what is wrong with private ssh key and port knocking?

 

[Szafi]

219 views and only 5 comments? Write if you are using and comment. I'm curious

 

[totolol123]

I never knew about that, simple but nice tutorial

 

[hellboy]

Nice tutorial!

However it looks like your screwed if you dont have one of those new fancy smart phones unless there is some alternative.

Type in google: "firefox gauth".

 

[Tipic]

what is wrong with private ssh key and port knocking?

prosze o kontakt!

 

[Szafi]

prosze o kontakt!

PW if you need help