diff --git a/Security/README.md b/Security/README.md new file mode 100644 index 0000000..f6ecf9c --- /dev/null +++ b/Security/README.md @@ -0,0 +1,3 @@ +

+Security +

\ No newline at end of file diff --git a/Security/SSH/README.md b/Security/SSH/README.md new file mode 100644 index 0000000..574d5ea --- /dev/null +++ b/Security/SSH/README.md @@ -0,0 +1,66 @@ +

+SSH +

+ +# Add TOTP on ssh connection +For a more secure ssh connection, you can add TOTP (Time-based One-Time Password) to your ssh connection. +This will require you to enter a password and a TOTP code to connect to your server. +This is a good way to add an extra layer of security to your server. + +## Installing Google Authenticator PAM +```bash +sudo apt install libpam-google-authenticator +``` +## Configuring SSHD for Google PAM +1. Edit the sshd configuration file + ```bash + sudo nano /etc/pam.d/sshd + ``` +2. Modified the file to look like this + ```bash + # PAM configuration for the Secure Shell service + + # Standard Un*x authentication. + #@include common-auth + + . . . + + # Standard Un*x password updating. + @include common-password + auth required pam_google_authenticator.so nullok + ``` + Comment out the `@include common-auth` for disable password authentication. + `nullok` allows users without a TOTP code to connect without one. +3. Edit the sshd configuration file + ```bash + sudo nano /etc/ssh/sshd_config + ``` +4. Add the following line to the bottom of the file + ```bash + . . . + # Change to yes to enable challenge-response passwords (beware issues with + # some PAM modules and threads) + ChallengeResponseAuthentication yes + . . . + UsePAM yes + AuthenticationMethods publickey,password publickey,keyboard-interactive + . . . + ``` +5. Restart the sshd service + ```bash + sudo systemctl restart sshd + ``` + +## Generating the Google Authenticator QR Code +1. Run the following command + ```bash + google-authenticator + ``` +2. Answer the following questions +3. Scan the QR code with your Google Authenticator app +4. Save the emergency scratch codes in a safe place +5. Restart the sshd service + ```bash + sudo systemctl restart sshd + ``` + diff --git a/_glossary.md b/_glossary.md index ea225db..e69de29 100644 --- a/_glossary.md +++ b/_glossary.md @@ -1,53 +0,0 @@ -##### FTAM -File Transfer and Access Management - -##### ASN.1 -Abstract Syntax Notation One - -##### CLNP -Connectionless Network Protocol - -##### HDLC -High-Level Data Link Control - -##### HTTP -HyperText Transfer Protocol - -##### FTP -File Transfer Protocol - -##### TCP -Transprot Control Protocol - -##### UDP -User Datagram Protocol - -##### SPX -Sequenced Packet eXchange - -##### IP -Internet Protocol - -##### IPX -Internetwork Packet eXchange - -##### SDU -Service Data Unit - Unité de données du service. - -##### SAP -Service Access Point - Point d'accès au service - -##### PDU -Protocol Data Unit - Unité de données du protocole - -##### Service Primitives -Actions de service (request, indication, response, confirm). - -##### PH -Protocol Header - En-tête du protocole - -##### Layer -Couche du modèle OSI - -##### Peer Entity -Entité pair (entité similaire sur une autre couche) \ No newline at end of file