Yggdrasil/legacy_docs/Security/SSH/README.md

SSH

Add TOTP on ssh connection

For a more secure ssh connection, you can add TOTP (Time-based One-Time Password) to your ssh connection. This will require you to enter a password and a TOTP code to connect to your server. This is a good way to add an extra layer of security to your server.

Installing Google Authenticator PAM

sudo apt install libpam-google-authenticator

Configuring SSHD for Google PAM

1. Edit the sshd configuration file

   sudo nano /etc/pam.d/sshd
   

2. Modified the file to look like this

   # PAM configuration for the Secure Shell service
   
   # Standard Un*x authentication.
   #@include common-auth
   
   . . .
   
   # Standard Un*x password updating.
   @include common-password
   auth required pam_google_authenticator.so nullok
   

   Comment out the @include common-auth for disable password authentication. nullok allows users without a TOTP code to connect without one.
3. Edit the sshd configuration file

   sudo nano /etc/ssh/sshd_config
   

4. Add the following line to the bottom of the file

   . . .
   # Change to yes to enable challenge-response passwords (beware issues with
   # some PAM modules and threads)
   ChallengeResponseAuthentication yes
   . . .
   UsePAM yes
   AuthenticationMethods publickey,password publickey,keyboard-interactive
   . . .
   

5. Restart the sshd service

   sudo systemctl restart sshd
   

Generating the Google Authenticator QR Code

1. Run the following command

   google-authenticator
   

2. Answer the following questions
3. Scan the QR code with your Google Authenticator app
4. Save the emergency scratch codes in a safe place
5. Restart the sshd service

   sudo systemctl restart sshd