Multi Factor Authentication with SSH - Revision history

Admin: /* Setup the MFA client */

2020-12-23T12:20:41Z

Setup the MFA client

← Older revision		Revision as of 12:20, 23 December 2020
Line 52:		Line 52:
	34932150		34932150
	44659216		44659216

			=SSH Client configuration for jump hosts=
			*~/.ssh/config

			Host target-server
			Hostname IP-OF-TARGET
			User username (optional)
			ProxyJump username@EXTERNAL-IP-OF-JUMP-SERVER
			IdentityFile ~/.ssh/id_rsa

	=Alternative methods=		=Alternative methods=

2020-12-23T12:16:22Z

Enforce MFA together with public keys

@@ Line 32: / Line 32: @@
 NOTE that this setup will allow users to login using public keys but MFA will still apply. <br>
 Users without a public key cannot login
 =Alternative methods=

2020-12-23T12:02:31Z

Reference

← Older revision		Revision as of 12:02, 23 December 2020
Line 42:		Line 42:

	*https://ubuntu.com/tutorials/configure-ssh-2fa#2-installing-and-configuring-required-packages<br>		*https://ubuntu.com/tutorials/configure-ssh-2fa#2-installing-and-configuring-required-packages<br>
	'https://serverfault.com/questions/629883/trying-to-get-ssh-with-public-key-no-password-google-authenticator-working-o<br>		*https://serverfault.com/questions/629883/trying-to-get-ssh-with-public-key-no-password-google-authenticator-working-o<br>
	'https://www.techrepublic.com/article/how-to-combine-ssh-key-authentication-and-two-factor-authentication-on-linux/<br>		*https://www.techrepublic.com/article/how-to-combine-ssh-key-authentication-and-two-factor-authentication-on-linux/<br>

2020-12-23T12:02:14Z

Reference

← Older revision		Revision as of 12:02, 23 December 2020
Line 41:		Line 41:
	=Reference=		=Reference=

	*https://ubuntu.com/tutorials/configure-ssh-2fa#2-installing-and-configuring-required-packages		*https://ubuntu.com/tutorials/configure-ssh-2fa#2-installing-and-configuring-required-packages<br>
	'https://serverfault.com/questions/629883/trying-to-get-ssh-with-public-key-no-password-google-authenticator-working-o		'https://serverfault.com/questions/629883/trying-to-get-ssh-with-public-key-no-password-google-authenticator-working-o<br>
	'https://www.techrepublic.com/article/how-to-combine-ssh-key-authentication-and-two-factor-authentication-on-linux/		'https://www.techrepublic.com/article/how-to-combine-ssh-key-authentication-and-two-factor-authentication-on-linux/<br>

2020-12-23T12:01:56Z

Alternative methods

← Older revision		Revision as of 12:01, 23 December 2020
Line 38:		Line 38:

	* auth sufficient pam_google_authenticator.so		* auth sufficient pam_google_authenticator.so

			=Reference=

			*https://ubuntu.com/tutorials/configure-ssh-2fa#2-installing-and-configuring-required-packages
			'https://serverfault.com/questions/629883/trying-to-get-ssh-with-public-key-no-password-google-authenticator-working-o
			'https://www.techrepublic.com/article/how-to-combine-ssh-key-authentication-and-two-factor-authentication-on-linux/

2020-12-23T12:01:27Z

Alternative methods

← Older revision		Revision as of 12:01, 23 December 2020
Line 35:		Line 35:
	=Alternative methods=		=Alternative methods=

	* auth [success=done new_authtok_reqd=done default=die] pam_google_authenticator.so nullok		* auth [success=done new_authtok_reqd=done default=die] pam_google_authenticator.so nullok

	* auth sufficient pam_google_authenticator.so		* auth sufficient pam_google_authenticator.so

2020-12-23T12:01:15Z

Enforce MFA together with public keys

← Older revision		Revision as of 12:01, 23 December 2020
Line 32:		Line 32:
	NOTE that this setup will allow users to login using public keys but MFA will still apply. <br>		NOTE that this setup will allow users to login using public keys but MFA will still apply. <br>
	Users without a public key cannot login		Users without a public key cannot login

			=Alternative methods=

			* auth [success=done new_authtok_reqd=done default=die] pam_google_authenticator.so nullok

			* auth sufficient pam_google_authenticator.so

2020-12-23T11:57:32Z

Enforce MFA together with public keys

← Older revision		Revision as of 11:57, 23 December 2020
Line 29:		Line 29:
	UsePAM yes		UsePAM yes
	'''AuthenticationMethods publickey,keyboard-interactive'''		'''AuthenticationMethods publickey,keyboard-interactive'''

			NOTE that this setup will allow users to login using public keys but MFA will still apply. <br>
			Users without a public key cannot login

2020-12-23T11:56:04Z

Default Setup

@@ Line 6: / Line 6: @@
 =Default Setup=
 *Configuration /etc/pam.d/sshd
-Put the following sting underneath of @include common-auth
+Put the following sting underneath of '''@include common-auth'''
   auth required pam_google_authenticator.so
@@ Line 16: / Line 16: @@
 '''NOTE''' that this setup will allow users to bypass the MFA setup when using '''public keys'''

2020-12-23T11:53:58Z

Default Setup

← Older revision		Revision as of 11:53, 23 December 2020
Line 14:		Line 14:
	ChallengeResponseAuthentication yes		ChallengeResponseAuthentication yes
	UsePAM yes		UsePAM yes

			'''NOTE''' that this setup will allow users to bypass the MFA setup when using '''public keys'''