<story><title>Add two-factor authentication to your ssh in 30 seconds</title><url>http://blog.authy.com/add-two-factor-authentication-to-your-ssh-in-30-seconds/</url></story><parent_chain><item><author>danielpal</author><text>The biggest problems is you can&apos;t use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh.&lt;p&gt;Also what happens if you loose your cellphone? We thought about this and for us the  possibility of loosing access to the server fully was too much.</text></item><item><author>cs702</author><text>Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing &lt;i&gt;libpam-google-authenticator&lt;/i&gt; from Ubuntu&apos;s &quot;universe&quot; repository.&lt;p&gt;Here&apos;s how you do it: first, &lt;i&gt;sudo apt-get install libpam-google-authenticator&lt;/i&gt;; second, run &lt;i&gt;google-authenticator&lt;/i&gt; as the user you will access remotely and follow the instructions; then, edit &lt;i&gt;/etc/pam.d/sshd,&lt;/i&gt; and add &quot;auth required pam_google_authenticator.so&quot; in a new line; edit &lt;i&gt;/etc/ssh/sshd_config&lt;/i&gt; and add (or change) the ChallengeResponseAuthentication line so it reads &quot;ChallengeResponseAuthentication yes&quot;; and finally, &lt;i&gt;sudo service ssh restart&lt;/i&gt; to restart the ssh server.&lt;p&gt;More info is available from the packager of libpam-google-authenticator[1], and from the Google Authenticator PAM module&apos;s README.[2]&lt;p&gt;--&lt;p&gt;[1] &lt;a href=&quot;http://blog.theroux.ca/security/ubuntu-2-step-authentication-with-google-authenticator/&quot; rel=&quot;nofollow&quot;&gt;http://blog.theroux.ca/security/ubuntu-2-step-authentication...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http://code.google.com/p/google-authenticator/source/browse/libpam/README&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/google-authenticator/source/browse/...&lt;/a&gt;&lt;p&gt;--&lt;p&gt;Edits: Corrected typos; added more context.</text></item></parent_chain><comment><author>jlgreco</author><text>Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication).&lt;p&gt;If not, it might be possible to configure PAM with some sort of keys module set to &apos;sufficient&apos;, then have PAM fall back on two-factor auth paired with pam_unix.&lt;p&gt;In fact, I&apos;ll see if I can get either of those working a bit later today.  Seems like it could be neat.</text></comment>
<story><title>Add two-factor authentication to your ssh in 30 seconds</title><url>http://blog.authy.com/add-two-factor-authentication-to-your-ssh-in-30-seconds/</url></story><parent_chain><item><author>danielpal</author><text>The biggest problems is you can&apos;t use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh.&lt;p&gt;Also what happens if you loose your cellphone? We thought about this and for us the  possibility of loosing access to the server fully was too much.</text></item><item><author>cs702</author><text>Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing &lt;i&gt;libpam-google-authenticator&lt;/i&gt; from Ubuntu&apos;s &quot;universe&quot; repository.&lt;p&gt;Here&apos;s how you do it: first, &lt;i&gt;sudo apt-get install libpam-google-authenticator&lt;/i&gt;; second, run &lt;i&gt;google-authenticator&lt;/i&gt; as the user you will access remotely and follow the instructions; then, edit &lt;i&gt;/etc/pam.d/sshd,&lt;/i&gt; and add &quot;auth required pam_google_authenticator.so&quot; in a new line; edit &lt;i&gt;/etc/ssh/sshd_config&lt;/i&gt; and add (or change) the ChallengeResponseAuthentication line so it reads &quot;ChallengeResponseAuthentication yes&quot;; and finally, &lt;i&gt;sudo service ssh restart&lt;/i&gt; to restart the ssh server.&lt;p&gt;More info is available from the packager of libpam-google-authenticator[1], and from the Google Authenticator PAM module&apos;s README.[2]&lt;p&gt;--&lt;p&gt;[1] &lt;a href=&quot;http://blog.theroux.ca/security/ubuntu-2-step-authentication-with-google-authenticator/&quot; rel=&quot;nofollow&quot;&gt;http://blog.theroux.ca/security/ubuntu-2-step-authentication...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http://code.google.com/p/google-authenticator/source/browse/libpam/README&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/google-authenticator/source/browse/...&lt;/a&gt;&lt;p&gt;--&lt;p&gt;Edits: Corrected typos; added more context.</text></item></parent_chain><comment><author>keidian</author><text>You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn&apos;t pass it. Not the best way, but one option.&lt;p&gt;I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can&apos;t find the link right off though as I&apos;m at work currently. If I find it, I&apos;ll add it here</text></comment>