The tutorial is about how we can protect ssh with Google Authenticator on Ubuntu 14.04 LTS server . Google authenticator is a security application which implements time based one time password (TOTP) security tokens. It is often also called as “Two steps verification” .
The server in which Google Authenticator has been setup , to get ssh access to this server require username, password and secret key (Generated by google authenticator application) .
We have setup the Google Authenticator in AWS Ubuntu 14.04 LTS server instance . Below given is roadmap –
1. Install Google Autheticator package.
2. Configure PAM sshd configuration file.
3. Configure ssh server.
4. Create system user and set password.
5. Generate QR code , secret key and verification code for newly created user.
6. Reference for Google Authenticator application in your mobile, Desktop (Linux or Ubuntu) .
7. Access the server via ssh with username
1. Install Google Autheticator package
Login into Ubuntu server and install the google authenticator package.
sudo apt-get update sudo apt-get install libpam-google-authenticator
2. Configure PAM sshd configuration file
We will edit the PAM’s sshd config file. We will take the backup of this file first.
sudo cp -pvf /etc/pam.d/sshd ~/sshd.original.pam.`date +%F`
Now edit the PAM sshd file and configure the Google authenticator module in it.
vi /etc/pam.d/sshd ## Add the below given line in top of /etc/pam.d/sshd file auth required pam_google_authenticator.so
The below given is reference from our server. So it will help you at what position the line should be added.
[email protected]:~$ egrep -v '^#|^$' /etc/pam.d/sshd @include common-auth auth required pam_google_authenticator.so account required pam_nologin.so @include common-account session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close session required pam_loginuid.so session optional pam_keyinit.so force revoke @include common-session session optional pam_motd.so motd=/run/motd.dynamic noupdate session optional pam_motd.so #  session optional pam_mail.so standard noenv #  session required pam_limits.so session required pam_env.so #  session required pam_env.so user_readenv=1 envfile=/etc/default/locale session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open @include common-password [email protected]:~$
3. Configure ssh server
Now we are configuring the ssh server and edit the sshd_config file. This is also one of the important steps so that it can work with Google Authenticator module which we have set in PAM.
As always next step, take the backup of sshd_config file.
sudo cp -pv /etc/ssh/sshd_config sshd_config.orig.`date +%F`
Now to make it work with google authenticator, edit the sshd_config file and set the parameters as given in below section –
sudo vi /etc/ssh/sshd_config # edit the below given parmaters ChallengeResponseAuthentication yes PasswordAuthentication yes UsePAM yes
After saving the sshd_config file. Restart the ssh server
sudo service ssh restart
3. Create system user and set password
Now we will create one user and set its password in server. Then we will generate QR code and keys used by this user for login into server .
For giving example, we are creating a user called sharad and setting its password. Replace the username sharad with your desired username in system .
sudo useradd -m -d /home/sharad sharad sudo passwd sharad
5. Generate QR code , secret key and verification code for newly created user
As we have seen in above 4th step, we have created a user called sharad. Now we will generate the QR code and its keys. Generating the QR code and keys is very simple method.
Login to user by using su command in server . (Note: We are still in Server)
sudo su -l sharad
Now we will generate code and keys by using below given command from user’s shell.
It will generate QR code and keys. We would like to share the screenshot taken from our server. Hope it will help you to understand more easily.
6. Reference for Google Authenticator application in your mobile, Desktop (Linux or Ubuntu)
To generate verification code , we have to install Google Authenticator apps in our Mobile phones or system .
With this Google Authenticator apps verification code will be generated.
We will talk about how to use Google authenticator apps on your system in new upcoming post with more details.
7. Access the server via ssh with username
Now access the server with user which you have created and generated its QR codes and keys.
It will ask for the password which you set in server and verification code which you will generate from Google authenticator apps.
See the below given reference from our system
[email protected]:~$ ssh [email protected] Password: Verification code: Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-44-generic x86_64) * Documentation: https://help.ubuntu.com/ System information as of Sun Mar 1 15:25:29 UTC 2015 System load: 0.0 Processes: 109 Usage of /: 10.2% of 7.74GB Users logged in: 1 Memory usage: 7% IP address for eth0: 172.31.62.251 Swap usage: 0% Graph this data and manage this system at: https://landscape.canonical.com/ Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud Last login: Sun Mar 1 15:25:29 2015 from 220.127.116.11 $ $ $ Connection to ec2-52-1-130-111.compute-1.amazonaws.com closed. [email protected]:~$