How to enable SSH multi-factor authentication in Ubuntu Server

by ddos ·

Authentication is a very important step for server management. Through the verification process, you can prove your rights and permissions. For example: Who are you? what can you do? Generally, everyone uses an account and password to log in to SSH. A cautious Linux administrator will use a key pair to verify the identity of the SSH user.

Everyone knows that SSH uses passwords for authentication by default, even if you use SSH keys instead of passwords. Because it is a single-factor authentication method, once the key is leaked, it will still endanger the server security. To solve this problem, in this article we will introduce how to enable SSH multi-factor authentication (MFA) for Ubuntu Server. Once enabled, different authentication factors such as the computer or phone you bind to when logging in to SSH are required to log in successfully.
A common authentication method is to use an OATH-TOTP application, such as Google Authenticator (which is used by Microsoft Account’s two-step authentication feature). OATH-TOTP (Time-based One-time Password algorithm) is an open protocol that is used to generate different one-time passwords, typically a new 6-digit verification code is generated every 30 seconds.
Below we will introduce how to use the OATH-TOTP application to complete SSH login authentication, thereby replacing the original SSH password or key authentication method of the system, making the server management more secure.
  1. Install libpam-google-authenticator

    sudo apt install libpam-google-authenticator

    After libpam-google-authenticator is installed, we need to generate a TOTP key for each user to be re-authenticated. This Key is generated on a user basis, not system-wide. In other words, users who want to log in to SSH using the TOTP authentication program must obtain and maintain their own keys separately.


  2.  Run command google-authenticator

    After executing the above command, the program will ask questions. The first question is to ask whether to generate a time-based authentication token. Google PAM supports time-based or sequence-based access tokens. When using a sequence-based token, the token code needs to be incremented for each visit; the time-based access token will randomly change within a certain period of time, and it will be more like a Google Authenticator, so we choose yes here.

    Do you want me to update your “/home/ddos/.google_authenticator” file? (y/n) y

    Do you want to disallow multiple uses of the same authentication token? This restricts you to one login  bout every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) y

    By default, a new token is generated every 30 seconds by the mobile app. In order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. This allows for a time skew of up to 30 seconds between authentication server and client. If you experience problems with poor time synchronization, you can increase the window from its default size of 3 permitted codes (one previous code, the current code, the next code) to 17 permitted codes (the 8 previous codes, the current code, and the 8 next codes). This will permit for a time skew of up to 4 minutes between client and server. Do you want to do so? (y/n) y

    If the computer that you are logging into isn’t hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting? (y/n) y

  3. At this time, please use the QR code scanned by Google Authenticator to add it to Google ’s OATH-TOTP application. Once it is successfully added, a new entry will appear and the 6-digit token will be refreshed every 30 seconds.

    After completing the above steps, all the configuration of Google PAM is completed.
  4. Configure OpenSSH to support MFA
    1. Add the following to the end of /etc/pam.d/sshd: auth required pam_google_authenticator.so nullok
      The final nullok is to tell PAM that this authentication method is optional. At this time, the user can still use the SSH password and a key to log in at the same time.
    2. Next, we need to configure SSH to support this method of authentication. Edit the /etc/ssh/sshd_config configuration file, configure the ChallengeResponseAuthentication to yes, and restart the SSH service
      sudo service ssh restart
  5. Login to ssh-service
    ddos@DESKTOP-UVQDIBV:# ssh root@192.168.79.130
    Password:
    Verification code:
    ddos@DESKTOP-UVQDIBV:#

Tags: SSH multi-factor authentication