Lorem ipsum dolor sit amet, consectetur adipiscing elit lobortis arcu enim urna adipiscing praesent velit viverra sit semper lorem eu cursus vel hendrerit elementum morbi curabitur etiam nibh justo, lorem aliquet donec sed sit mi dignissim at ante massa mattis.
Vitae congue eu consequat ac felis placerat vestibulum lectus mauris ultrices cursus sit amet dictum sit amet justo donec enim diam porttitor lacus luctus accumsan tortor posuere praesent tristique magna sit amet purus gravida quis blandit turpis.
At risus viverra adipiscing at in tellus integer feugiat nisl pretium fusce id velit ut tortor sagittis orci a scelerisque purus semper eget at lectus urna duis convallis. porta nibh venenatis cras sed felis eget neque laoreet suspendisse interdum consectetur libero id faucibus nisl donec pretium vulputate sapien nec sagittis aliquam nunc lobortis mattis aliquam faucibus purus in.
Nisi quis eleifend quam adipiscing vitae aliquet bibendum enim facilisis gravida neque. Velit euismod in pellentesque massa placerat volutpat lacus laoreet non curabitur gravida odio aenean sed adipiscing diam donec adipiscing tristique risus. amet est placerat in egestas erat imperdiet sed euismod nisi.
“Nisi quis eleifend quam adipiscing vitae aliquet bibendum enim facilisis gravida neque velit euismod in pellentesque massa placerat”
Eget lorem dolor sed viverra ipsum nunc aliquet bibendum felis donec et odio pellentesque diam volutpat commodo sed egestas aliquam sem fringilla ut morbi tincidunt augue interdum velit euismod eu tincidunt tortor aliquam nulla facilisi aenean sed adipiscing diam donec adipiscing ut lectus arcu bibendum at varius vel pharetra nibh venenatis cras sed felis eget dolor cosnectur drolo.
Last week, Google enabled two factor authentication for everyone. This article explains how to install and configure Google Authenticator in conjunction with SSH for two factor authentication. Two-factor authentication relies on something you know (a password) and something you have (your phone).Update: I have posted another article describing this same implementation with a Yubikey.You can use this existing implementation and Google Authenticator application with SSH via an included PAM in the Google Authenticator open source application.
First, download and install Google Authenticator on your Iphone/Android/Blackberry.
You may need a few dependencies. On RHEL 5 I was missing 'pam-devel'.$ hg clone https://google-authenticator.googlecode.com/hg/ google-authenticator/$ cd google-authenticator/libpam/$ make$ sudo make install$ sudo vi /etc/pam.d/sshdAdd the following line to the beginning of /etc/pam.d/sshd:auth required pam_google_authenticator.soYou also need to update /etc/ssh/sshd_config and add/update:ChallengeResponseAuthentication yes
As a user, you can now run 'google-authenticator'. This will generate a secret key, and add a file to your home directory that the newly installed PAM uses.$ google-authenticatorhttps://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/user@host.com%3Fsecret%3DAAAAAAAAAAAAAAAAYour new secret key is: AAAAAAAAAAAAAAAAYour verification code is 123123Your emergency scratch codes are: 81283812 18283182 18128381 38383838 18283120Do you want me to update your "~/.google_authenticator" file (y/n) yDo you want to disallow multiple uses of the same authenticationtoken? This restricts you to one login about every 30s, but it increasesyour chances to notice or even prevent man-in-the-middle attacks (y/n) yNote: The emergency scratch codes are one-time use verification codes in the event your phone is unavailable.
In your Google Authenticator application on your phone, add this new secret key that was generated in the previous step. Note, a URL is also displayed, that can be scanned from your Google Authenticator application.
You will now need to restart SSH for the pam/ssh changes to activate.At this point, you will want to stay logged into the server while you test in another shell.
Test that two-factor authentication is working.$ ssh example.comVerification code:Password:[user@host ~]$Enter the verification code as shown on your phone.
We provide 24x7 monitoring and response, proactive updates, and more. Priced per server, per month. Give us a call at 888-877-7118 or click here for further detail.