Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over SSH. However, when logging in from an untrusted machine there's always the risk of a keylogger capturing my password as I type it.

FreeBSD already has support for OPIE which is a one-time password scheme. This works great, but the one-time password is the only authentication needed. If I print out a list of one-time passwords to use later, then if I lose that list then that's all somebody needs.

I'd like to set up the authentication so that I need a one-time password plus something I know (a password, except not my usual login password). I have a feeling the answer has something to do with PAM (and /etc/pam.d/sshd) but I'm not certain on the details.

How can I set up authentication where two methods are required?

share|improve this question

4 Answers 4

Since you want to use a password that is something other than the one for your normal account, try security/pam_pwdfile from the ports tree.
Basically, it allows you to use an alternate file (format: username:crypted_password) to authenticate against.
To use it, put the following line in /etc/pam.d/sshd right before the line for pam_opie:

auth    required    /usr/local/lib/pam_pwdfile.so    pwdfile    /path/to/pwd/file
share|improve this answer

Duo Security (our company) offers an open-source package that supports OTP, phone callback, SMS, and smartphone push authentication for SSH with passwords, pubkey, or any primary auth mechanism - with or without PAM:

http://blog.duosecurity.com/2011/04/announcing-duos-two-factor-authentication-for-unix/

share|improve this answer

Assuming this uses pam, it should be as simple as putting two required modules in /etc/pam.d/. One for Opie, and one for your other auth. (say, normal UNIX password)

share|improve this answer

Consider using pam-radius. It should compile on BSD. All enterprise-capable two-factor authentication systems support radius. Radius is a very standard standard so you will gain great flexibility.

HTH.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.