add totp in security/ssh (#13)
This commit is contained in:
3 files changed
+69
-53
No files matched your search
@@ -0,0 +1,3 @@
|
||||
<header><h1>
|
||||
Security
|
||||
</h1></header>
|
||||
@@ -0,0 +1,66 @@
|
||||
<header><h1>
|
||||
SSH
|
||||
</h1></header>
|
||||
|
||||
# Add TOTP on ssh connection
|
||||
For a more secure ssh connection, you can add TOTP (Time-based One-Time Password) to your ssh connection.
|
||||
This will require you to enter a password and a TOTP code to connect to your server.
|
||||
This is a good way to add an extra layer of security to your server.
|
||||
|
||||
## Installing Google Authenticator PAM
|
||||
```bash
|
||||
sudo apt install libpam-google-authenticator
|
||||
```
|
||||
## Configuring SSHD for Google PAM
|
||||
1. Edit the sshd configuration file
|
||||
```bash
|
||||
sudo nano /etc/pam.d/sshd
|
||||
```
|
||||
2. Modified the file to look like this
|
||||
```bash
|
||||
# PAM configuration for the Secure Shell service
|
||||
|
||||
# Standard Un*x authentication.
|
||||
#@include common-auth
|
||||
|
||||
. . .
|
||||
|
||||
# Standard Un*x password updating.
|
||||
@include common-password
|
||||
auth required pam_google_authenticator.so nullok
|
||||
```
|
||||
Comment out the `@include common-auth` for disable password authentication.
|
||||
`nullok` allows users without a TOTP code to connect without one.
|
||||
3. Edit the sshd configuration file
|
||||
```bash
|
||||
sudo nano /etc/ssh/sshd_config
|
||||
```
|
||||
4. Add the following line to the bottom of the file
|
||||
```bash
|
||||
. . .
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication yes
|
||||
. . .
|
||||
UsePAM yes
|
||||
AuthenticationMethods publickey,password publickey,keyboard-interactive
|
||||
. . .
|
||||
```
|
||||
5. Restart the sshd service
|
||||
```bash
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
## Generating the Google Authenticator QR Code
|
||||
1. Run the following command
|
||||
```bash
|
||||
google-authenticator
|
||||
```
|
||||
2. Answer the following questions
|
||||
3. Scan the QR code with your Google Authenticator app
|
||||
4. Save the emergency scratch codes in a safe place
|
||||
5. Restart the sshd service
|
||||
```bash
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
##### FTAM
|
||||
File Transfer and Access Management
|
||||
|
||||
##### ASN.1
|
||||
Abstract Syntax Notation One
|
||||
|
||||
##### CLNP
|
||||
Connectionless Network Protocol
|
||||
|
||||
##### HDLC
|
||||
High-Level Data Link Control
|
||||
|
||||
##### HTTP
|
||||
HyperText Transfer Protocol
|
||||
|
||||
##### FTP
|
||||
File Transfer Protocol
|
||||
|
||||
##### TCP
|
||||
Transprot Control Protocol
|
||||
|
||||
##### UDP
|
||||
User Datagram Protocol
|
||||
|
||||
##### SPX
|
||||
Sequenced Packet eXchange
|
||||
|
||||
##### IP
|
||||
Internet Protocol
|
||||
|
||||
##### IPX
|
||||
Internetwork Packet eXchange
|
||||
|
||||
##### SDU
|
||||
Service Data Unit - Unité de données du service.
|
||||
|
||||
##### SAP
|
||||
Service Access Point - Point d'accès au service
|
||||
|
||||
##### PDU
|
||||
Protocol Data Unit - Unité de données du protocole
|
||||
|
||||
##### Service Primitives
|
||||
Actions de service (request, indication, response, confirm).
|
||||
|
||||
##### PH
|
||||
Protocol Header - En-tête du protocole
|
||||
|
||||
##### Layer
|
||||
Couche du modèle OSI
|
||||
|
||||
##### Peer Entity
|
||||
Entité pair (entité similaire sur une autre couche)
|
||||
Reference in new issue
Block a user