{"id":2238,"date":"2022-11-13T07:24:27","date_gmt":"2022-11-13T07:24:27","guid":{"rendered":"https:\/\/cdblog.cdstealer.com\/?p=2238"},"modified":"2022-11-13T16:41:25","modified_gmt":"2022-11-13T16:41:25","slug":"2238","status":"publish","type":"post","link":"https:\/\/cdblog.cdstealer.com\/?p=2238","title":{"rendered":"2FA for SSH\/GDM"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\n
\n

Please emerge qrencode and google-authenticator-libpam-hardened.
At the time of writing this, you have to install the MASKED version.<\/p>\n\n\n\n

Ensure that your terminal is 90x56 to retain the QR code.<\/p>\n\n\n\n

\n
ACCEPT_KEYWORDS=\"**\" emerge -av google-authenticator-libpam-hardened\n\nThese are the packages that would be merged, in order:\n\nCalculating dependencies\u2026 done!\n[ebuild N ] sys-auth\/oath-toolkit-2.6.2-r2::gentoo USE=\"pam -pskc -static-libs -test\" 4,196 KiB\n[ebuild N ] sys-auth\/google-authenticator-libpam-hardened-9999::gentoo USE=\"qrcode\" 0 KiB<\/pre>\n<\/div><\/div>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n
Execute google-authenticator as the user<\/p>\n\n\n\n
\n
\n
$ google-authenticator\n\nDo you want authentication tokens to be time-based (y\/n) y\n\n\"\"\n\nYour new secret key is: jeronimo!\nYour potential verification codes are 012345 012345 012345 012345 012345\nYour emergency scratch codes are:\n  88888888\n  88888888\n  88888888\n  88888888\n  88888888\n\nDo you want me to update your \"\/home\/<user>\/.google_authenticator\" file? (y\/n) y\n\nDo you want to disallow multiple uses of the same authentication\ntoken? This restricts you to one login about every 30s, but it increases\nyour chances to notice or even prevent man-in-the-middle attacks (y\/n) y\n\nBy default, a new token is generated every 30 seconds by the mobile app.\nIn order to compensate for possible time-skew between the client and the server,\nwe allow an extra token before and after the current time. This allows for a\ntime skew of up to 30 seconds between authentication server and client. If you\nexperience problems with poor time synchronization, you can increase the window\nfrom its default size of 3 permitted codes (one previous code, the current\ncode, the next code) to 17 permitted codes (the 8 previous codes, the current\ncode, and the 8 next codes). This will permit for a time skew of up to 4 minutes\nbetween client and server.\nDo you want to do so? (y\/n) y\n\nIf the computer that you are logging into isn't hardened against brute-force\nlogin attempts, you can enable rate-limiting for the authentication module.\nBy default, this limits attackers to no more than 3 login attempts every 30s.\nDo you want to enable rate-limiting? (y\/n) y<\/pre>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n
Open \/etc\/pam.d\/system-login with your editor and add these 2 lines at the bottom:<\/p>\n\n\n\n
auth required pam_google_authenticator.so nullok
auth required pam_permit.so<\/pre>\n\n\n\n
Configure SSHD<\/h2>\n\n\n\n
Open \/etc\/sshd\/sshd_config in your editor and ensure the following settings are present.<\/p>\n\n\n\n
PubkeyAuthentication no\nPasswordAuthentication yes\nUsePAM yes\nChallengeResponseAuthentication yes<\/pre>\n\n\n\n
Note:  If pubkey is enabled, it will override 2FA completely.<\/p>\n\n\n\n
GDM<\/h2>\n\n\n\n
Editing \/etc\/pam.d\/system-login as above should be enough, just restart the gdm service :)
You'll use your normal password and then be prompted for your 2FA code.<\/p>\n\n\n\n
QR Codes<\/h2>\n\n\n\n
You can generate your own QR codes on the cli and output to screen or image file.<\/p>\n\n\n\n
qrencode -t ansi -l H -o - <STRING><\/pre>\n\n\n\n
will output to screen.<\/p>\n\n\n\n
 qrencode -s30 -l H -o qrcode.png <STRING><\/pre>\n\n\n\n
will output to png.<\/p>\n","protected":false},"excerpt":{"rendered":"
Please emerge qrencode and google-authenticator-libpam-hardened.At the time of writing this, you have to install the MASKED version. Ensure that your terminal is 90x56 to retain the QR code. ACCEPT_KEYWORDS=\"**\" emerge -av google-authenticator-libpam-hardened These are the packages that would be merged, in order: Calculating dependencies\u2026 done! [ebuild N ] sys-auth\/oath-toolkit-2.6.2-r2::gentoo USE=\"pam -pskc -static-libs -test\" 4,196 KiB … Continue reading 2FA for SSH\/GDM<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[280,323,324,213,165,243],"class_list":["post-2238","post","type-post","status-publish","format-standard","hentry","category-gentoo","tag-2fa","tag-authenticator","tag-gdm","tag-gentoo","tag-google","tag-ssh"],"_links":{"self":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/2238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2238"}],"version-history":[{"count":14,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/2238\/revisions"}],"predecessor-version":[{"id":2262,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/2238\/revisions\/2262"}],"wp:attachment":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}