add totp in security/ssh (#13)
This commit is contained in:
3 files changed
+69
-53
No files matched your search
@@ -0,0 +1,3 @@
|
|||||||
|
<header><h1>
|
||||||
|
Security
|
||||||
|
</h1></header>
|
||||||
@@ -0,0 +1,66 @@
|
|||||||
|
<header><h1>
|
||||||
|
SSH
|
||||||
|
</h1></header>
|
||||||
|
|
||||||
|
# Add TOTP on ssh connection
|
||||||
|
For a more secure ssh connection, you can add TOTP (Time-based One-Time Password) to your ssh connection.
|
||||||
|
This will require you to enter a password and a TOTP code to connect to your server.
|
||||||
|
This is a good way to add an extra layer of security to your server.
|
||||||
|
|
||||||
|
## Installing Google Authenticator PAM
|
||||||
|
```bash
|
||||||
|
sudo apt install libpam-google-authenticator
|
||||||
|
```
|
||||||
|
## Configuring SSHD for Google PAM
|
||||||
|
1. Edit the sshd configuration file
|
||||||
|
```bash
|
||||||
|
sudo nano /etc/pam.d/sshd
|
||||||
|
```
|
||||||
|
2. Modified the file to look like this
|
||||||
|
```bash
|
||||||
|
# PAM configuration for the Secure Shell service
|
||||||
|
|
||||||
|
# Standard Un*x authentication.
|
||||||
|
#@include common-auth
|
||||||
|
|
||||||
|
. . .
|
||||||
|
|
||||||
|
# Standard Un*x password updating.
|
||||||
|
@include common-password
|
||||||
|
auth required pam_google_authenticator.so nullok
|
||||||
|
```
|
||||||
|
Comment out the `@include common-auth` for disable password authentication.
|
||||||
|
`nullok` allows users without a TOTP code to connect without one.
|
||||||
|
3. Edit the sshd configuration file
|
||||||
|
```bash
|
||||||
|
sudo nano /etc/ssh/sshd_config
|
||||||
|
```
|
||||||
|
4. Add the following line to the bottom of the file
|
||||||
|
```bash
|
||||||
|
. . .
|
||||||
|
# Change to yes to enable challenge-response passwords (beware issues with
|
||||||
|
# some PAM modules and threads)
|
||||||
|
ChallengeResponseAuthentication yes
|
||||||
|
. . .
|
||||||
|
UsePAM yes
|
||||||
|
AuthenticationMethods publickey,password publickey,keyboard-interactive
|
||||||
|
. . .
|
||||||
|
```
|
||||||
|
5. Restart the sshd service
|
||||||
|
```bash
|
||||||
|
sudo systemctl restart sshd
|
||||||
|
```
|
||||||
|
|
||||||
|
## Generating the Google Authenticator QR Code
|
||||||
|
1. Run the following command
|
||||||
|
```bash
|
||||||
|
google-authenticator
|
||||||
|
```
|
||||||
|
2. Answer the following questions
|
||||||
|
3. Scan the QR code with your Google Authenticator app
|
||||||
|
4. Save the emergency scratch codes in a safe place
|
||||||
|
5. Restart the sshd service
|
||||||
|
```bash
|
||||||
|
sudo systemctl restart sshd
|
||||||
|
```
|
||||||
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
##### FTAM
|
|
||||||
File Transfer and Access Management
|
|
||||||
|
|
||||||
##### ASN.1
|
|
||||||
Abstract Syntax Notation One
|
|
||||||
|
|
||||||
##### CLNP
|
|
||||||
Connectionless Network Protocol
|
|
||||||
|
|
||||||
##### HDLC
|
|
||||||
High-Level Data Link Control
|
|
||||||
|
|
||||||
##### HTTP
|
|
||||||
HyperText Transfer Protocol
|
|
||||||
|
|
||||||
##### FTP
|
|
||||||
File Transfer Protocol
|
|
||||||
|
|
||||||
##### TCP
|
|
||||||
Transprot Control Protocol
|
|
||||||
|
|
||||||
##### UDP
|
|
||||||
User Datagram Protocol
|
|
||||||
|
|
||||||
##### SPX
|
|
||||||
Sequenced Packet eXchange
|
|
||||||
|
|
||||||
##### IP
|
|
||||||
Internet Protocol
|
|
||||||
|
|
||||||
##### IPX
|
|
||||||
Internetwork Packet eXchange
|
|
||||||
|
|
||||||
##### SDU
|
|
||||||
Service Data Unit - Unité de données du service.
|
|
||||||
|
|
||||||
##### SAP
|
|
||||||
Service Access Point - Point d'accès au service
|
|
||||||
|
|
||||||
##### PDU
|
|
||||||
Protocol Data Unit - Unité de données du protocole
|
|
||||||
|
|
||||||
##### Service Primitives
|
|
||||||
Actions de service (request, indication, response, confirm).
|
|
||||||
|
|
||||||
##### PH
|
|
||||||
Protocol Header - En-tête du protocole
|
|
||||||
|
|
||||||
##### Layer
|
|
||||||
Couche du modèle OSI
|
|
||||||
|
|
||||||
##### Peer Entity
|
|
||||||
Entité pair (entité similaire sur une autre couche)
|
|
||||||
Reference in new issue
Block a user