0

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made some slight modifications. Namely, I want to allow the following authentication methods

  • password followed by OATH-TOTP (google-authenticator)
  • public key followed by OATH-TOTP (google-authenticator)

However for whatever reason, when I try to SSH to the hypervisor from one of the VMs to test this configuration, I am never prompted for my google-authenticator code. This is what I see in /var/log/auth.log

[root@vm1 ~]# ssh 192.168.86.2
root@192.168.86.2's password: 
Permission denied, please try again.
root@hypervisor:~# tail -f /var/log/auth.log
...
Apr 17 08:58:53 pve1-gkh8ww1 sshd(pam_google_authenticator)[8971]: Invalid verification code
Apr 17 08:58:54 pve1-gkh8ww1 sshd[8971]: Failed password for root from 192.168.86.3 port 54948 ssh2

I know I have typed the password in correctly, because I just logged in with it. So I tried running with more verbose output, both on the client, and on the server.

From the client

debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
root@192.168.86.2's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.

From the server

debug1: KEX done [preauth]
debug1: userauth-request for user root service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: authentication methods list 0: password,keyboard-interactive
debug1: authentication methods list 1: publickey,keyboard-interactive
debug1: authentication methods list 0: password,keyboard-interactive [preauth]
debug1: authentication methods list 1: publickey,keyboard-interactive [preauth]
debug1: PAM: initializing for "root"
debug1: PAM: setting PAM_RHOST to "192.168.86.3"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user root service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: userauth_pubkey: test whether pkalg/pkblob are acceptable for RSA SHA256:5OtnlHMBJnFp75gii09+T8zQdJcFoHlI0wHZoL8i8wU [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug1: fd 4 clearing O_NONBLOCK
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 192.168.86.3 port 54954 ssh2: RSA SHA256:5OtnlHMBJnFp75gii09+T8zQdJcFoHlI0wHZoL8i8wU

debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 2 failures 1 [preauth]
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 192.168.86.3 port 54954 ssh2

Particularly, I am confused by this line from the client

debug1: Authentications that can continue: publickey,password

This does not seem to match the debug output of the server.

debug1: authentication methods list 0: password,keyboard-interactive
debug1: authentication methods list 1: publickey,keyboard-interactive

I have explicitly set the AuthenticationMethods directive in /etc/ssh/sshd_config on the server, as well as other necessary directives

AuthenticationMethods password,keyboard-interactive publickey,keyboard-interactive

ChallengeResponseAuthentication yes 

PermitRootLogin yes

PasswordAuthentication yes

UsePAM yes

Here are the relevant parts of my /etc/pam.d/sshd

# Standard Un*x authentication.
@include common-auth
...
...
# Standard Un*x password updating.
@include common-password
auth required pam_google_authenticator.so
  • 1
    I am seeing auth required pam_google_authenticator.so nullok in your own provided link. – Rui F Ribeiro Apr 17 at 13:49
  • 1
    @RuiFRibeiro "The nullok word at the end of the last line tells the PAM that this authentication method is optional. This allows users without a OATH-TOTP token to still log in using their SSH key. Once all users have an OATH-TOTP token, you can remove nullok from this line to make MFA mandatory." – Timothy Pulliam Apr 17 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.