0

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made some slight modifications. Namely, I want to allow the following authentication methods

  • password followed by OATH-TOTP (google-authenticator)
  • public key followed by OATH-TOTP (google-authenticator)

However for whatever reason, when I try to SSH to the hypervisor from one of the VMs to test this configuration, I am never prompted for my google-authenticator code. This is what I see in /var/log/auth.log

[root@vm1 ~]# ssh 192.168.86.2
root@192.168.86.2's password: 
Permission denied, please try again.
root@hypervisor:~# tail -f /var/log/auth.log
...
Apr 17 08:58:53 pve1-gkh8ww1 sshd(pam_google_authenticator)[8971]: Invalid verification code
Apr 17 08:58:54 pve1-gkh8ww1 sshd[8971]: Failed password for root from 192.168.86.3 port 54948 ssh2

I know I have typed the password in correctly, because I just logged in with it. So I tried running with more verbose output, both on the client, and on the server.

From the client

debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
root@192.168.86.2's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.

From the server

debug1: KEX done [preauth]
debug1: userauth-request for user root service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: authentication methods list 0: password,keyboard-interactive
debug1: authentication methods list 1: publickey,keyboard-interactive
debug1: authentication methods list 0: password,keyboard-interactive [preauth]
debug1: authentication methods list 1: publickey,keyboard-interactive [preauth]
debug1: PAM: initializing for "root"
debug1: PAM: setting PAM_RHOST to "192.168.86.3"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user root service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: userauth_pubkey: test whether pkalg/pkblob are acceptable for RSA SHA256:5OtnlHMBJnFp75gii09+T8zQdJcFoHlI0wHZoL8i8wU [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug1: fd 4 clearing O_NONBLOCK
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 192.168.86.3 port 54954 ssh2: RSA SHA256:5OtnlHMBJnFp75gii09+T8zQdJcFoHlI0wHZoL8i8wU

debug1: userauth-request for user root service ssh-connection method password [preauth]
debug1: attempt 2 failures 1 [preauth]
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 192.168.86.3 port 54954 ssh2

Particularly, I am confused by this line from the client

debug1: Authentications that can continue: publickey,password

This does not seem to match the debug output of the server.

debug1: authentication methods list 0: password,keyboard-interactive
debug1: authentication methods list 1: publickey,keyboard-interactive

I have explicitly set the AuthenticationMethods directive in /etc/ssh/sshd_config on the server, as well as other necessary directives

AuthenticationMethods password,keyboard-interactive publickey,keyboard-interactive

ChallengeResponseAuthentication yes 

PermitRootLogin yes

PasswordAuthentication yes

UsePAM yes

Here are the relevant parts of my /etc/pam.d/sshd

# Standard Un*x authentication.
@include common-auth
...
...
# Standard Un*x password updating.
@include common-password
auth required pam_google_authenticator.so
  • 1
    I am seeing auth required pam_google_authenticator.so nullok in your own provided link. – Rui F Ribeiro Apr 17 '19 at 13:49
  • 1
    @RuiFRibeiro "The nullok word at the end of the last line tells the PAM that this authentication method is optional. This allows users without a OATH-TOTP token to still log in using their SSH key. Once all users have an OATH-TOTP token, you can remove nullok from this line to make MFA mandatory." – Timothy Pulliam Apr 17 '19 at 13:53
0

The answer is simply that it is not possible to request two factors with password authentication, but with an explanation for you that will help get things working. You're looking at password authentication as the way to use a password. This is incorrect.

'password authentication' is a simple request for a single password. There's no specific prompt sent by the server to the client. It's the client that chooses how to label the prompt- such as when it asks "Enter password for user@host:".

'keyboard-interactive' is a more complex request for arbitrary number of pieces of information. For each piece of information the server sends the label for the prompt. Moreover it allows the server to provide a description of the form of the response it expects. The server can also specify which inputs are secret (passwords need to be obfuscated on screen) and which are not (OTPs)

In majority of cases the keyboard-interactive authentication is used to request the single "secret" password prompt, so there's hardly any difference compared to the password authentication for the end user.

Since keyboard-interactive is an authentication mechanism that allows the server to send multiple challenge/response pairs, the Google Authenticator PAM plug-in needs it to send two questions- the password and the OTP.

So password authentication will NEVER work with Google Authenticator, since it doesn't have the ability to prompt for more than one thing. Google Authenticator will work with private-keys and the OTP into the password prompt (though not ideally). Google Authenticator will work with keyboard-interactive with the password and the OTP. Google Authenticator will NOT work with a password prompt as it cannot ask for the right information.

In your client software, prioritize keyboard-interactive over password and you'll be set with getting the two prompts with your current configuration. To avoid having it at all, we can disable password authentication entirely.

So how to fix:

Remove password as a supported authentication method and rely on keyboard-interactive for your password authentications. Set "PasswordAuthentication no" in /etc/ssh/sshd_config

So: /etc/ssh/sshd_config

UsePAM yes
PasswordAuthentication no
ChallengeResponseAuthentication yes
PubkeyAuthentication yes
# I don't use AuthenticationMethods at all and rely on my yes/no's

/etc/pam.d/sshd (at the bottom)

auth required pam_google_authenticator.so nullok

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.