Although this method doesn't check for 1 method of authentication, it does solve the problem of logging in from insecure/not-trusted machines using OTP.
To configure the SSH daemon to listen on multiple ports (one for public key authentication and the other for OTP authentication), simply add another port number to the sshd_config file, i.e.
Port 22 # For key-based auth
Port 60000 # For OTP-based auth
The 2-FA is based on Google’s 2-step authentication technology. To install the library and the program:
$ sudo apt-get install libpam-google-authenticator
Meanwhile, install the Google Authenticator app on your smartphone. Once installed, from the terminal, start up the program:
$ google-authenticator
This will give you a barcode, a secret and a bunch of scratch codes. KEEP THEM SAFE!!! If you don’t have access to your phone or otherwise need emergency access these codes will be your only way in. Don’t underestimate how important this backup mechanism is. It might screw you in the long run.
Configure the PAM module to use Google Authenticator:
$ sudo nano /etc/pam.d/sshd
To disable password login therafter, put a # in front of the line @include common-auth. Also, to the bottom of the file, add:
auth required pam_google_authenticator.so
To enable OTP authentication:
$ sudo nano /etc/ssh/sshd_config
Find the line with the phrase: ChallengeResponseAuthentication
and change it from “no” to “yes”.
Set PermitRootLogin no
and PasswordAuthentication no
.
At the end of the file, use the “match” parameter to determine which authentication mechanism(s) have to be used to access the machine from that port, for example:
Match LocalPort 22
PasswordAuthentication no
AuthenticationMethods publickey
PubKeyAuthentication yes
Match LocalPort 60000
AuthenticationMethods keyboard-interactive:pam
The parameter “keyboard-interactive:pam” forces the SSH daemon to go to the PAM module daemon (configured under /etc/pam.d/sshd
) and authenticate as specified there (hence the need to disable password login from the PAM module as well, by hashing out the common-auth
line).
Don’t forget to restart your SSH daemon for the changes to take effect:
$ sudo /etc/init.d/sshd restart
Then, when at a non-trusted machine, simply SSH into port 60000 (or whatever you set) and use OTP to authenticate.