add totp in security/ssh (#13)

This commit is contained in:
Rémi Heredero authored and GitHub committed 2024-02-28 07:34:51 +01:00
commit 7a6970f89e
3 files changed
+69 -53

No files matched your search

+3
View File
@@ -0,0 +1,3 @@
<header><h1>
Security
</h1></header>
+66
View File
@@ -0,0 +1,66 @@
<header><h1>
SSH
</h1></header>
# Add TOTP on ssh connection
For a more secure ssh connection, you can add TOTP (Time-based One-Time Password) to your ssh connection.
This will require you to enter a password and a TOTP code to connect to your server.
This is a good way to add an extra layer of security to your server.
## Installing Google Authenticator PAM
```bash
sudo apt install libpam-google-authenticator
```
## Configuring SSHD for Google PAM
1. Edit the sshd configuration file
```bash
sudo nano /etc/pam.d/sshd
```
2. Modified the file to look like this
```bash
# PAM configuration for the Secure Shell service
# Standard Un*x authentication.
#@include common-auth
. . .
# Standard Un*x password updating.
@include common-password
auth required pam_google_authenticator.so nullok
```
Comment out the `@include common-auth` for disable password authentication.
`nullok` allows users without a TOTP code to connect without one.
3. Edit the sshd configuration file
```bash
sudo nano /etc/ssh/sshd_config
```
4. Add the following line to the bottom of the file
```bash
. . .
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication yes
. . .
UsePAM yes
AuthenticationMethods publickey,password publickey,keyboard-interactive
. . .
```
5. Restart the sshd service
```bash
sudo systemctl restart sshd
```
## Generating the Google Authenticator QR Code
1. Run the following command
```bash
google-authenticator
```
2. Answer the following questions
3. Scan the QR code with your Google Authenticator app
4. Save the emergency scratch codes in a safe place
5. Restart the sshd service
```bash
sudo systemctl restart sshd
```
-53
View File
@@ -1,53 +0,0 @@
##### FTAM
File Transfer and Access Management
##### ASN.1
Abstract Syntax Notation One
##### CLNP
Connectionless Network Protocol
##### HDLC
High-Level Data Link Control
##### HTTP
HyperText Transfer Protocol
##### FTP
File Transfer Protocol
##### TCP
Transprot Control Protocol
##### UDP
User Datagram Protocol
##### SPX
Sequenced Packet eXchange
##### IP
Internet Protocol
##### IPX
Internetwork Packet eXchange
##### SDU
Service Data Unit - Unité de données du service.
##### SAP
Service Access Point - Point d'accès au service
##### PDU
Protocol Data Unit - Unité de données du protocole
##### Service Primitives
Actions de service (request, indication, response, confirm).
##### PH
Protocol Header - En-tête du protocole
##### Layer
Couche du modèle OSI
##### Peer Entity
Entité pair (entité similaire sur une autre couche)