2-Factor Authentication (2FA) is a simple way to help improve the security of your systems. It restricts the scope of damage if a machine is compromised. If, for instance, you have a security token or authenticator app on your phone that is required for ssh to a remote machine, then even if every laptop you use to connect to the remote is totally owned, an attacker cannot establish a new ssh session on their own.
There are a lot of tutorials out there on the Internet that get you about halfway there, so here is some more detail.
Background
In this article, I will be focusing on authentication in the style of Google Authenticator, which is a special case of OATH HOTP or TOTP. You can use the Google Authenticator app, FreeOTP, or a hardware token like Yubikey to generate tokens with this. They are all 100% compatible with Google Authenticator and libpam-google-authenticator.
The basic idea is that there is a pre-shared secret key. At each login, a different and unique token is required, which is generated based on the pre-shared secret key and some other information. With TOTP, the other information is the current time, implying that both machines must be reasably well in-sync time-wise. With HOTP, the other information is a count of the number of times the pre-shared key has been used. Both typically have a window on the server side that can let times within a certain number of seconds, or a certain number of login accesses, work.
The beauty of this system is that after the initial setup, no Internet access is required on either end to validate the key (though TOTP requires both ends to be reasonably in sync time-wise).
The basics: user account setup and ssh authentication
You can start with the basics by reading one of these articles:
one,
two,
three. Debian/Ubuntu users will find both the pam module and the user account setup binary in libpam-google-authenticator.
For many, you can stop there. You re done. But if you want to kick it up a notch, read on:
Enhancement 1: Requiring 2FA even when ssh public key auth is used
Let s consider a scenario in which your system is completely compromised. Unless your ssh keys are also stored in something like a Yubikey Neo, they could wind up being compromised as well if someone can read your files and sniff your keyboard, your ssh private keys are at risk.
So we can configure ssh and PAM so that a OTP token is required even for this scenario.
First off, in /etc/ssh/sshd_config, we want to change or add these lines:
UsePAM yes
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
This forces all authentication to pass two verification methods in ssh: publickey and keyboard-interactive. All users will have to supply a public key and then also pass keyboard-interactive auth. Normally keyboard-interactive auth prompts for a password, but we can change /etc/pam.d/sshd on this. I added this line at the very top of /etc/pam.d/sshd:
auth [success=done new_authtok_reqd=done ignore=ignore default=bad] pam_google_authenticator.so
This basically makes Google Authenticator both necessary and sufficient for keyboard-interactive in ssh. That is, whenever the system wants to use keyboard-interactive, rather than prompt for a password, it instead prompts for a token. Note that any user that has not set up google-authenticator already will be completely unable to ssh into their account.
Enhancement 1, variant 2: Allowing automated processes to root
On many of my systems, I have ~root/.ssh/authorized_keys set up to permit certain systems to run locked-down commands for things like backups. These are automated commands, and the above configuration will break them because I m not going to be typing in codes at 3AM.
If you are very restrictive about what you put in root s authorized_keys, you can exempt the root user from the 2FA requirement in ssh by adding this to sshd_config:
Match User root
AuthenticationMethods publickey
This says that the only way to access the root account via ssh is to use the authorized_keys file, and no 2FA will be required in this scenario.
Enhancement 1, variant 2: Allowing non-pubkey auth
On some multiuser systems, some users may still want to use password auth rather than publickey auth. There are a few ways we can support that:
- Users without public keys will have to supply a OTP and a password, while users with public keys will have to supply public key, OTP, and a password
- Users without public keys will have to supply OTP or a password, while users with public keys will have to supply public key, OTP, or a password
- Users without public keys will have to supply OTP and a password, while users with public keys only need to supply the public key
The third option is covered in any number of third-party tutorials. To enable options 1 or 2, you ll need to put this in sshd_config:
AuthenticationMethods publickey,keyboard-interactive keyboard-interactive
This means that to authenticate, you need to pass either publickey and then keyboard-interactive auth, or just keyboard-interactive auth.
Then in /etc/pam.d/sshd, you put this:
auth required pam_google_authenticator.so
As a sub-variant for option 1, you can add nullok to here to permit auth from people that do not have a Google Authenticator configuration.
Or for option 2, change required to sufficient . You should not add nullok in combination with sufficient, because that could let people without a Google Authenticator config authenticate completely without a password at all.
Enhancement 2: Configuring su
A lot of other tutorials stop with ssh (and maybe gdm) but forget about the other ways we authenticate or change users on a system. su and sudo are the two most important ones. If your root password is compromised, you don t want anybody to be able to su to that account without having to supply a token. So you can set up google-authenticator for root.
Then, edit /etc/pam.d/su and insert this line after the pam_rootok.so line:
auth required pam_google_authenticator.so nullok
The reason you put this after pam_rootok.so is because you want to be able to su from root to any account without having to input a token. We add nullok to the end of this, because you may want to su to accounts that don t have tokens. Just make sure to configure tokens for the root account first.
Enhancement 3: Configuring sudo
This one is similar to su, but a little different. This lets you, say, secure the root password for sudo.
Normally, you might sudo from your user account to root (if so configured). You might have sudo configured to require you to enter in your own password (rather than root s), or to just permit you to do whatever you want as root without a password.
Our first step, as always, is to configure PAM. What we do here depends on your desired behavior: do you want to require someone to supply both a password and a token, or just a token, or require a token? If you want to require a token, put this at the top of /etc/pam.d/sudo:
auth [success=done new_authtok_reqd=done ignore=ignore default=bad] pam_google_authenticator.so
If you want to require a token and a password, change the bracketed string to required , and if you want a token or a password, change it to sufficient . As before, if you want to permit people without a configured token to proceed, add nullok , but do not use that with sufficient or the bracketed example here.
Now here comes the fun part. By default, if a user is required to supply a password to sudo, they are required to supply their own password. That does not help us here, because a user logged in to the system can read the ~/.google_authenticator file and easily then supply tokens for themselves. What you want to do is require them to supply root s password. Here s how I set that up in sudoers:
Defaults:jgoerzen rootpw
jgoerzen ALL=(ALL) ALL
So now, with the combination of this and the PAM configuration above, I can sudo to the root user without knowing its password but only if I can supply root s token. Pretty slick, eh?
Further reading
In addition to the basic tutorials referenced above, consider:
Edit: additional comments
Here are a few other things to try:
First, the libpam-google-authenticator module supports putting the Google Authenticator files in different locations and having them owned by a certain user. You could use this to, for instance, lock down all secret keys to be readable only by the root user. This would prevent users from adding, changing, or removing their own auth tokens, but would also let you do things such as reusing your personal token for the root account without a problem.
Also, the
pam-oath module does much of the same things as the libpam-google-authenticator module, but without some of the help for setup. It uses a single monolithic root-owned password file for all accounts.
There is an oathtool that can be used to generate authentication codes from the command line.
There s a 
Please note that the environment it runs on is deployment . The backend server it uses is the great Starman, also by the great Miyagawa.
Now, if you add or change dependencies on Makefile.PL, next time you push, those will get updated.
Very cool, right? :)
A couple of quick wins
There are a couple of little fixes and improvements on which I m not going to spend too much time on, but which I list for completeness anyway just in case they come in handy for a similar project of yours:
Add the Ethereum APT repository using these commands:
The 
Unless you're into hardware hacking and want to hook wires up to the GPIO
pins, the best hardware feature is the complete keyboard, with even
Escape and Control and arrow keys. You can ssh around and run vi on it,
run your favorite REPL (I use ghci) to do quick programming, etc.
The keyboard is small and a little strange, but you get used
to it quickly; your QWERTY muscle memory is transferrable to it.
I had fun installing nethack on it and handing it to my sister who
had never played nethack before, to watch her learn to play.
The screen resolution is 480x272, which is pretty tiny. And, it's a cheap
resistive touchscreen, with a bezil around it. This makes it very hard to
use scroll bars and icons near the edge of the screen. The customized
interface that ships with it avoids these problems, and so I've been using
that for now. When I have time, I plan to put a fullscreen window
manager on it, and write a 
Talks have been finished, and as a special present to the participants, Pavneet has organized an excursion that probably was one of the best I ever had. First we visited the 
During the ceremony, Pavneet also announced the winners of the 
I have a long overdue blog entry about what happened in recent times. People that follow 
After the closing of the session, one part of our group went off to the baseball match, while another group dived into a Japanese-style Izakaya where we managed to kill huge amounts of sake and quite an amount of food. The photo shows me after the first bottle of sake, while just seeping on an intermediate small amount of genshu (kind of strong undiluted sake) before continuing to the next bottle.
An interesting and stimulating first day of TUG, and I am sure that everyone was looking forward to day 2.
I'm looking at large touring frames and am currently thinking
of the 
Version 0.0.5 of