0

I am writing a bash script on ubuntu 16.04 and I want to setup Two factor authentification via SMS on SSH connection to the server. I saw that there is a way to do it with a google authentication system. But for that the client must download an app first. I want to send a SMS (simple text that contain a code) to a cell phone that the user will use plus his password to gain access to the server. Even if I can use a service or a non-free gateway via an api to send the SMS. Could you help me please?? Thanks you.

  • 1
    The basic solution is going to involve a PAM module. However I would strongly recommend using that google solution, or something similar. What if your box loses internet connection? Or your user has no phone signal? Google authenticator is an offline solution that doesn't require the server or the client to have internet. Or what if your user gets charged for SMS messages? – Patrick Mar 12 '18 at 12:20
  • However if you really want to go down the route, google for "pam 2 factor sms". Lots of results pop up. – Patrick Mar 12 '18 at 12:23
0

I think you should build an web service or web server to connect SMS Gateway first.

Then you can use CURL to call to your web service.

That's my idea!

  • 1
    While this is in the direction of a solution, I'm not sure it is an Answer yet. Granted, the question is broad and asks only if we can help them, but I believe the intention is clear -- to configure exactly such an SMS service. – Jeff Schaller Oct 12 '18 at 17:42
-1

Even if you not apply my answer, I hope some things will help you.

I will omit implementation details because it will depend on your API.

Assume that you use 'bash', therefore in home directory for each user you can create '.bashrc' (if it has not exists yet) and put some program that simply send SMS to user and return password which has sent. If timeout or password mismatch, then logout user. It's need to trap signals 2, 11, 15 to prevent STOP/KILL events. I write pseudo-code for clarify:

~/.bashrc:

trap_signals
sent_password = send_sms_program <msisdn> <timeout>
print "Enter password: "
input_password = read_password_from_console
if (<timeout>) {
   logout
} else {
  if (input_password == key) {
     exit
  } else {
    logout
  }
}
  • You can't use the user's bashrc for this. When this file executes, the user has already authenticated and been accepted by the system. It would probably not be hard to bypass this by simply executing another shell, or ask bash not to read the bashrc file. – Kusalananda Mar 12 '18 at 12:16
  • Aye, this is trivial to get around. ssh example.com some-command-here will skip evaluation of .bashrc. – Patrick Mar 12 '18 at 12:18
  • Agreed. I hurried with answer and omit that user can run another program instead of command interpreter. I know that '.bashrc' executing on already authenticated users, but I haven't consider that another program may be executed. – Yurij Goncharuk Mar 12 '18 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.