Tag Archives: google

Linux

2FA for SSH/GDM

Please emerge qrencode and google-authenticator-libpam-hardened.
At the time of writing this, you have to install the MASKED version.

Ensure that your terminal is 90x56 to retain the QR code.

ACCEPT_KEYWORDS="**" emerge -av google-authenticator-libpam-hardened

These are the packages that would be merged, in order:

Calculating dependencies… done!
[ebuild N ] sys-auth/oath-toolkit-2.6.2-r2::gentoo USE="pam -pskc -static-libs -test" 4,196 KiB
[ebuild N ] sys-auth/google-authenticator-libpam-hardened-9999::gentoo USE="qrcode" 0 KiB

Execute google-authenticator as the user

$ google-authenticator

Do you want authentication tokens to be time-based (y/n) y



Your new secret key is: jeronimo!
Your potential verification codes are 012345 012345 012345 012345 012345
Your emergency scratch codes are:
  88888888
  88888888
  88888888
  88888888
  88888888

Do you want me to update your "/home/<user>/.google_authenticator" file? (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y

Open /etc/pam.d/system-login with your editor and add these 2 lines at the bottom:

auth required pam_google_authenticator.so nullok
auth required pam_permit.so

Configure SSHD

Open /etc/sshd/sshd_config in your editor and ensure the following settings are present.

PubkeyAuthentication no
PasswordAuthentication yes
UsePAM yes
ChallengeResponseAuthentication yes

Note: If pubkey is enabled, it will override 2FA completely.

GDM

Editing /etc/pam.d/system-login as above should be enough, just restart the gdm service :)
You'll use your normal password and then be prompted for your 2FA code.

QR Codes

You can generate your own QR codes on the cli and output to screen or image file.

qrencode -t ansi -l H -o - <STRING>

will output to screen.

 qrencode -s30 -l H -o qrcode.png <STRING>

will output to png.

Linux

Nexus Unlock and Root/Unroot.

Original post is here.

Before beginning, you’ll want to install the Android SDK tools onto your computer so you can use tools such as fastboot and adb. Otherwise, you won’t be able to communicate with your Nexus device.  On Gentoo this is done by adding dev-util/android-tools to /etc/portage/package.keywords and then emerge -av dev-util/android-tools.

nexus4_lte_fastboot
Unlocking the Nexus device is really simply. Boot it up into fastboot mode — on the Nexus 4, this is done by holding the Power + Volume Down buttons at the same time. Once you see a screen like above, open up a command line terminal and (assuming you’re using Linux; adjust slightly as appropriate for other operating systems) type fastboot devices. If anything appears from this command, the computer recognizes the Nexus device. Then, type fastboot oem unlock, and accept the warning shown on the Nexus device by navigating with the Volume Buttons and accepting with the Power button. Congratulations, your Nexus device is now unlocked!

Rooting manually is a little tricky, because rooting the stock version of Android (the one that Google provided that originally came with the device) used to be pretty tricky. At least with a Nexus device, you just need to download a flashable CF-Auto-Root file and flash that onto the device, giving you root access. However, you’re still most likely going to need to use a custom recovery, and while you’re at it you may as well install a custom ROM onto your device (which won’t require an additional flash of CF-Auto-Root).

Unrooting your device is nearly impossible to do without flashing stock back onto your device. You’ll need to download the latest factory image from Google’s Android Developer Images site, and move the two included .img files from the .zip into a separate folder, and then open the secondary .zip and move those .img files into the same separate folder as well.

Then type the following commands into your computer while it is connected to the Nexus device:

  1. fastboot devices (to make sure that the computer sees your Nexus 4)
  2. fastboot flash bootloader bootloader_xxxx.img (Replace bootloader_xxxx.img with the actual file name)
  3. fastboot reboot-bootloader
  4. fastboot flash radio radio_xxxx.img (Replace radio_xxxx.img with the actual file name. For Android 4.3, the version should end in a .84)
  5. fastboot reboot-bootloader
  6. fastboot flash system system.img
  7. fastboot flash userdata userdata.img
  8. fastboot flash boot boot.img
  9. fastboot flash recovery recovery.img
  10. fastboot format cache (to remove any old traces of the old system)
  11. OPTIONAL: fastboot oem lock (this re-locks the bootloader to prevent future tinkering with the device, i.e. forces you to “unlock” the bootloader again and wipe the device before tinkering)
  12. fasboot reboot

Conclusion

You should now be back to a completely stock configuration for your Nexus device! Playing around with a Nexus device is a lot of fun, and it provides a great learning experience about how to tinker with Android. Above all, it can provide a lot of extra functionality (such as LTE functionality on the Nexus 4) that isn’t built into Android itself — you just have to go find it yourself.