<story><title>Hardening SSH with 2FA</title><url>https://gist.github.com/lizthegrey/9c21673f33186a9cc775464afbdce820</url></story><parent_chain><item><author>kylek</author><text>I&amp;#x27;ve thought about doing something like this several times, but the proposition of using any tools&amp;#x2F;libraries&amp;#x2F;pam modules&amp;#x2F;etc not installed by default, custom pam&amp;#x2F;sshd configs, and generally anything &amp;quot;outside of the box&amp;quot; sort of scares me.&lt;p&gt;I&amp;#x27;ve used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself be in practice? (Am I being paranoid for NOT wanting to go the extra mile to ensure that I actually have access to my systems when I need it the most?)</text></item></parent_chain><comment><author>kiallmacinnes</author><text>If all you care about is your SSH key not being stolen, then you can very easily use a YubiKey (or other smartcard..) with SSH via either GPG or PKCS11. Both will mean your key never leaves your YubiKey (or other smartcard...). This doesn&amp;#x27;t prevent your colleagues from having their key stolen, but does protect yours.&lt;p&gt;I can use the YubiKey for SSH from Linux, Mac, Android phones without issue, and I keep several YubiKeys with my keys on them so it&amp;#x27;s extremely unlikely I&amp;#x27;ll loose them all at once.&lt;p&gt;Re the paranoia - if you&amp;#x27;re really the only person who can fix something, and you have lost your closest key, then - the thing in need of fixing can wait till you get home to your second key ;)</text></comment>
<story><title>Hardening SSH with 2FA</title><url>https://gist.github.com/lizthegrey/9c21673f33186a9cc775464afbdce820</url></story><parent_chain><item><author>kylek</author><text>I&amp;#x27;ve thought about doing something like this several times, but the proposition of using any tools&amp;#x2F;libraries&amp;#x2F;pam modules&amp;#x2F;etc not installed by default, custom pam&amp;#x2F;sshd configs, and generally anything &amp;quot;outside of the box&amp;quot; sort of scares me.&lt;p&gt;I&amp;#x27;ve used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself be in practice? (Am I being paranoid for NOT wanting to go the extra mile to ensure that I actually have access to my systems when I need it the most?)</text></item></parent_chain><comment><author>alias_neo</author><text>I wrote a blog post on this recently, using only open-source tools that don&amp;#x27;t come from big corps. To have TOTP second factor on Debian (like) systems you need only libpam-oath module on the server, and perhaps an open-source app like FreeOTP (RedHat) on a smartphone.&lt;p&gt;I&amp;#x27;m afraid to link it here because the traffic might kill my puny box.</text></comment>