Hack The Sec-Leading Resource Of Linux Tutorial: secure sshd

Skip Google Authenticator Authentication if Logging in from the Local Network

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<h3 style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; clear: both; color: #333333; font-family: Lato, sans-serif; font-size: 22px; font-stretch: normal; font-weight: normal; line-height: 24px; margin: 36px 0px 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="color: red;"><u>Skip Google Authenticator Authentication if Logging in from the Local Network</u></span></h3>
<div style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; color: #333333; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
You may trust systems on you local network enough not not require that SSH connections from them use <b>Google Authenticator</b>. If so, modify <code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>/etc/pam.d/sshd</b></code> so that it looks like this:</div>
<div style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
<a href="http://www.hackthesec.co.in/2016/02/two-step-authentication-for-ssh-login-on-centos.html" itemprop="url" style="color: #141414; display: block; font-family: 'Open Sans', serif, sans-serif; font-size: 18.6px; font-weight: 600; line-height: normal; text-decoration: none;"></a><ul style="font-size: 18.6px; line-height: 19.2px; text-align: left;">
<li><span style="color: red; font-family: Open Sans, serif, sans-serif;"><span style="font-size: 18.6px; font-weight: 600; line-height: normal;"><a href="http://www.hackthesec.co.in/2016/02/two-step-authentication-for-ssh-login-on-centos.html" target="_blank"><span id="goog_1967741824"></span>Two-step Authentication For SSH On Centos 6</a></span></span></li>
<li><a href="http://www.hackthesec.co.in/2016/02/secure-ssh-with-google-authenticator.html" target="_blank"><span style="color: red;"><span style="font-family: Open Sans, serif, sans-serif;"><span style="display: block; font-size: 18.6px; font-size: 18.6px; font-weight: 600; line-height: normal;"></span></span><span id="goog_1967741825"></span></span><span style="color: red; text-decoration: none;">Secure SSH with Google Authenticator Two-Factor Authentication on CentOS 7</span></a></li>
</ul>
<div class="separator" style="clear: both; color: #333333; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYS0IxSN12lLLez9IvZFa1HS8zQCN9fClraK7cb9vDABhFu-5YP3LqCVEwwMrXmWL6UhTdm0TNzLGNR7j2eSwA7M8oIqS3yOdRW56OcLZHkD78d8tRAgjVuZXuReX1K_7Ik4Iy1Q42mpAH/s1600/TwoFactorAuthenticationWith-google_authenticator_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYS0IxSN12lLLez9IvZFa1HS8zQCN9fClraK7cb9vDABhFu-5YP3LqCVEwwMrXmWL6UhTdm0TNzLGNR7j2eSwA7M8oIqS3yOdRW56OcLZHkD78d8tRAgjVuZXuReX1K_7Ik4Iy1Q42mpAH/s200/TwoFactorAuthenticationWith-google_authenticator_www.hackthesec.co.in.jpg" width="200" /></a></div>
</div>
</div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: small;"><span style="line-height: 15.6px;">auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth       required     pam_google_authenticator.so</span></span></pre>
</div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;">Then add the file </span><code style="border: 0px; font-family: monospace, serif; font-size: 15px; line-height: 24px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>/etc/security/access-local.conf</b></code><span style="font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;"> with the contents:</span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: 'Courier New', Courier, monospace; font-size: small;"><span style="line-height: 15.6px;"><span style="color: lime;"><br /></span></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: small;"><span style="line-height: 15.6px;"># Google Authenticator can be skipped on local network
+ : ALL : 192.168.0.0/24
+ : ALL : LOCAL
- : ALL : ALL</span></span></pre>
</div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: small;"><span style="line-height: 15.6px;"><br /></span></span></div>
<div style="background-color: white; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: 'Courier New', Courier, monospace; font-size: small;"><span style="line-height: 15.6px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: small;"><br /></span></div>
</div>

Skip Google Authenticator Authentication if Logging in from the Local Network

Skip Google Authenticator Authentication if Logging in from the Local Network You may trust systems on you local network enough not not require that SSH connections from them use Google Authenticator…

26 Feb 2016

Two-step Authentication For SSH On Centos 6

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 33px; line-height: 1.09091; margin: 0px 0px 12px; outline: 0px; padding: 0px; text-transform: uppercase; vertical-align: baseline;">
<span style="color: red;"><u><i>TWO-STEP AUTHENTICATION FOR SSH ON CENTOS 6</i></u></span></h1>
<div>
<span style="color: black;"><a href="http://code.google.com/p/google-authenticator/" style="background-color: white; border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Google Authenticator</a><span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;"> implements TOTP (timebased one-time-password) security tokens from RFC6238 via the Google mobile app Google Authenticator. The Authenticator provides a six digit one-time password users must provide in addition to their username and password to login, sometimes branded “two-step authentication”. Here, we install and configure a pluggable authentication module (PAM) which allows login using one-time passcodes.</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi40xdu7C_0p2adgn-P278IjXylG1Np3bMARVFPqBxvRtTD4kPiTGPcx0B4ciBJST52hgQl4hU11YfHNBt5PN0MrCV5bfuU98qN5cd6Hr4Yb4eUB1Y1VMajsVrA-Iu86p-kS0cn8hSAkh93/s1600/TwoFactorAuthenticationWith-google_authenticator_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi40xdu7C_0p2adgn-P278IjXylG1Np3bMARVFPqBxvRtTD4kPiTGPcx0B4ciBJST52hgQl4hU11YfHNBt5PN0MrCV5bfuU98qN5cd6Hr4Yb4eUB1Y1VMajsVrA-Iu86p-kS0cn8hSAkh93/s1600/TwoFactorAuthenticationWith-google_authenticator_www.hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: black;"><span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;"><br /></span></span></div>
<div>
<ul style="background-color: white; display: block; font-family: 'Open Sans', serif, sans-serif; font-size: 18.6px; font-weight: 600; text-align: left; text-decoration: none;">
<li><span style="font-size: 18.6px;"><a href="http://www.hackthesec.co.in/2016/02/secure-ssh-with-google-authenticator.html" target="_blank"><span style="color: red;">Secure SSH with Google Authenticator Two-Factor Authentication on CentOS 7</span></a></span></li>
</ul>
</div>
<div>
<h3 style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 22px; line-height: 24px; margin: 36px 0px 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="color: #0b5394;"><u>Download and Install</u></span></h3>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
At the time of this writing, only an old version of <b>libpam-google-authenticator</b> is available in the <b><a href="http://www.hackthesec.co.in/2016/01/centos-rhel-scientific-linux-6-enable.html" target="_blank">EPEL package repository</a></b>. Hence, we are going to compile it from source. First, install prerequisites:</div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;">[root@hackthesec]# yum install </span><span style="color: lime;">make gcc pam-devel</span></span></span></pre>
</div>
<div>
<span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;">TOTP (timebased one-time-password) security tokens are time sensitive. Hence, make sure that your system has ntpd running, and is configured to start the service at boot:</span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> service </span><span style="color: orange;">ntpd start</span><span style="color: white;">

</span><span style="color: orange;">Starting </span><span style="color: white;">ntpd:                [  OK  ]

</span></span></span><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> </span><span style="color: lime;">chkconfig  </span><span style="color: white;">ntpd on</span></span></span></pre>
</div>
<div>
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><br /></span></span></div>
<div>
<span style="background-color: white;"><span style="font-family: Lato, sans-serif; font-size: large;"><span style="line-height: 24px;">Then download and install libpam-google-authenticator from source installation and compilation:</span></span></span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: lime;"><br /></span></span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"> cd /tmp

</span></span><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> </span><span style="color: lime;">wget </span><span style="color: white;">http://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2</span></span></span></pre>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;">
</span></span><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> </span><span style="color: lime;">bunzip2</span><span style="color: white;"> libpam-google-authenticator-1.0-source.tar.bz2
</span></span></span><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> </span><span style="color: lime;">tar xf</span><span style="color: white;"> libpam-google-authenticator-1.0-source.tar</span></span></span></pre>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;">
</span></span><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> cd </span><span style="color: lime;">libpam-google-authenticator-1.0</span><span style="color: white;">

gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o google-authenticator.o google-authenticator.c
gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o base32.o base32.c
gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o hmac.o hmac.c
gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o sha1.o sha1.c
gcc -g   -o google-authenticator google-authenticator.o base32.o hmac.o sha1.o  -ldl
gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o pam_google_authenticator.o pam_google_authenticator.c
gcc -shared -g   -o pam_google_authenticator.so pam_google_authenticator.o base32.o hmac.o sha1.o -lpam
gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o demo.o demo.c
gcc -DDEMO --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o pam_google_authenticator_demo.o pam_google_authenticator.c
gcc -g   -rdynamic -o demo demo.o pam_google_authenticator_demo.o base32.o hmac.o sha1.o  -ldl
gcc -DTESTING --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden        \
              -o pam_google_authenticator_testing.o pam_google_authenticator.c
gcc -shared -g   -o pam_google_authenticator_testing.so pam_google_authenticator_testing.o base32.o hmac.o sha1.o -lpam
gcc --std=gnu99 -Wall -O2 -g -fPIC -c  -fvisibility=hidden  -o pam_google_authenticator_unittest.o pam_google_authenticator_unittest.c
gcc -g   -rdynamic -o pam_google_authenticator_unittest pam_google_authenticator_unittest.o base32.o hmac.o sha1.o -lc  -ldl</span></span></span></pre>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: 'Courier New', Courier, monospace; font-size: medium; line-height: 15.6px;">[root@hackthesec]#</span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> </span><span style="color: lime;">make install</span><span style="color: white;">

cp pam_google_authenticator.so /lib64/security
cp google-authenticator /usr/local/bin</span></span></span></pre>
</div>
<div>
<h3 style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 22px; line-height: 24px; margin: 36px 0px 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="color: #0b5394;"><u>Set Up Google Authenticator</u></span></h3>
<div style="border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
Before configuring SSH, first set up Google Authenticator. Run “google-authenticator” <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: inherit; font-style: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">as the user you wish to log in with via SSH</span>. You will be prompted with a few questions.</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;">[root@hackthesec]# </span><span style="color: orange;">google-authenticator</span><span style="color: white;">

Do you want me to update your "~/.google_authenticator" file (y/n) y
 
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/user@server%3Fsecret%3DABCD12E3FGHIJKLMN
Your new secret key is: ABCD12E3FGHIJKLMN
Your verification code is 98765432
Your emergency scratch codes are:
  01234567
  89012345
  67890123
  45678901
  23456789
 
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
 
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y
 
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y</span></span></span></pre>
</div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: lime;"><br /></span></span></span></div>
<div>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
These settings are stored in the user’s <code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>~/.google_authenticator</b></code> file.</div>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
Copy and paste the URL into your browser and scan the QR code that is displayed with the app Google Authenticator on your mobile device. If you can’t scan the QR code, then you can enter the information manually with the given secret key and verification code. A new verification code should be displayed every 30 seconds.</div>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
Emergency one-time use verification codes are also given for you to write down in a secure place in case you were to not have your mobile device with you.</div>
<h3 style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 22px; line-height: 24px; margin: 36px 0px 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<u><span style="color: #0b5394;">Configure PAM</span></u></h3>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
Have PAM require Google Authenticator for SSH authentication. Modify<b> <code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">/etc/pam.d/sshd</code></b> and add the line “<code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>auth required pam_google_authenticator.so</b></code>” at the top.</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;">[root@hackthesec]# vi </span><span style="color: lime;">/etc/pam.d/sshd</span><span style="color: white;">

#%PAM-1.0
</span><span style="color: orange;">auth       required     pam_google_authenticator.so
</span><span style="color: white;">auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth</span></span></span></pre>
</div>
<div>
<div style="border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
This will require all users to use Google Authenticator for SSH authentication. To only require those users with Google Authenticator configured for their account (the <code style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>~/.google_authenticator</b></code> file exists), then instead enter “<code style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>auth required pam_google_authenticator.so</b></code><code style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; font-weight: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> </code><code style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>nullok</b></code>“.</div>
<div style="border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
The order in which you place items in this file matters. Given this configuration, you will first be prompted for your Google Authenticator verification code, then for your system account password when you SSH into the system.</div>
</div>
<div>
<h3 style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 22px; line-height: 24px; margin: 36px 0px 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="color: #0b5394;"><u>Configure the SSH Service</u></span></h3>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
Modify <b><code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">/etc/ssh/sshd_config</code>.</b> Verify these settings:</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="color: lime;"><span style="line-height: 15.6px;">[root@hackthesec]# vi /etc/ssh/sshd_config

PasswordAuthentication yes
</span></span><span style="color: white; line-height: 15.6px;">ChallengeResponseAuthentication yes
</span><span style="color: lime; line-height: 15.6px;">UsePAM yes</span></span></pre>
</div>
<div>
<span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;">Restart the SSH service:</span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="background-color: transparent; line-height: 15.6px;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;">[root@hackthesec]# </span></span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;">service </span><span style="color: lime;">sshd restart</span></span></span></pre>
</div>
<div>
<span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;">When you SSH into the system as a user configured for Google Authenticator, you will have to enter the verification code that is displayed in you Google Authenticator app, and then by your system password at the next prompt:</span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;">login as: root
</span><span style="color: orange;">Verification code: 002536
</span><span style="color: white;">Password: *******
[root@hackthesec]#</span></span></span></pre>
</div>
<div>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
If you have any problems, look in the <code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>/var/log/secure</b></code> system log file.</div>
<div style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
If you have <b>SELinux </b>enabled, you may not be able to login, and get this error in <code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>/var/log/secure</b></code>:</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;">Feb  26 23:42:50 hostname sshd(pam_google_authenticator)[1654]: Failed to update secret file "/home/hackthesec/.google_authenticator"
Feb  26 23:42:50 hostname  sshd[1652]: error: PAM: Cannot make/remove an entry for the specified session for username from 192.168.0.5</span></span></pre>
</div>
<div>
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><br /></span></span></div>
<div>
<div style="border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
This is probably due /home/username/.google_authenticator not having an appropriate <a href="http://wiki.centos.org/HowTos/SELinux" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: inherit; font-style: inherit; font-weight: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Type Enforcement</a> (TE):</div>
<div style="-webkit-text-stroke-width: 0px; color: black; font-family: 'Times New Roman'; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px;">
</div>
<br />
<div style="orphans: auto; text-align: left; text-indent: 0px; widows: 1;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin: 0px 0px 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="background-color: transparent; line-height: 15.6px;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;">[root@hackthesec]#</span></span><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: white;"> </span><span style="color: lime;">ls -Z /home/hackthesec/.google_authenticator</span><span style="color: white;">
-r--------. hackthesec hackthesec unconfined_u:object_r:user_home_t:s0 /home/hackthesec/.google_authenticator</span></span></span></pre>
</div>
</div>
<div>
<h3 style="border: 0px; clear: both; font-family: Lato, sans-serif; font-size: 22px; line-height: 24px; margin: 36px 0px 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="color: red;"><u>Skip Google Authenticator Authentication if Logging in from the Local Network</u></span></h3>
<div style="border: 0px; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px; margin-bottom: 24px; outline: 0px; padding: 0px; vertical-align: baseline;">
You may trust systems on you local network enough not not require that SSH connections from them use <b>Google Authenticator</b>. If so, modify <code style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>/etc/pam.d/sshd</b></code> so that it looks like this:</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;">auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth       required     pam_google_authenticator.so</span></span></pre>
</div>
<div>
<span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;">Then add the file </span><code style="background-color: white; border: 0px; font-family: monospace, serif; font-size: 15px; line-height: 24px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b>/etc/security/access-local.conf</b></code><span style="background-color: white; font-family: Lato, sans-serif; font-size: 16px; line-height: 24px;"> with the contents:</span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: lime;"><br /></span></span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"># Google Authenticator can be skipped on local network
+ : ALL : 192.168.0.0/24
+ : ALL : LOCAL
- : ALL : ALL</span></span></pre>
</div>
<div>
<span style="color: white; font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><br /></span></span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: lime;"><br /></span></span></span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: medium;"><span style="line-height: 15.6px;"><span style="color: lime;"><br /></span></span></span></div>
</div>

Two-step Authentication For SSH On Centos 6

TWO-STEP AUTHENTICATION FOR SSH ON CENTOS 6 Google Authenticator implements TOTP (timebased one-time-password) security tokens from RFC6238 via the Google mobile app Google Authenticator. The Authent…

26 Feb 2016

Secure SSH with Google Authenticator Two-Factor Authentication on CentOS 7

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 style="border-bottom-color: rgb(195, 202, 213); border-bottom-style: solid; border-bottom-width: 1px; color: #314d7c; font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 26px; margin: 0px 0px 15px; padding: 20px 0px;">
Google Authenticator Two-Factor Authentication on CentOS 7</h1>
<span style="background-color: white; font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">SSH access is always critical and you might want to find ways to improve the security of your SSH access. In this article we will see how we can secure SSH with simple two factor authentication by using Google Authenticator. Before using it you have to integrate the SSH daemon on your server with Google Authenticator one time password protocol TOTP and another restriction is that you must have your android phone with you all the time or at least the time you want <b>SSH access</b></span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEituG_vrQj2qbbwgkfPTj-hr01-z_SbSoir2VjHmPUmfztQDCX-xzh9UoCT-i_CI0PuUB6UeR69vAnWiVDbVFIo39trNQWXj3s743gRcnt_8tiuJyUV9pcfaOrbiM7g1_Z6vkAz7FYmH-jO/s1600/google-authenticator-www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEituG_vrQj2qbbwgkfPTj-hr01-z_SbSoir2VjHmPUmfztQDCX-xzh9UoCT-i_CI0PuUB6UeR69vAnWiVDbVFIo39trNQWXj3s743gRcnt_8tiuJyUV9pcfaOrbiM7g1_Z6vkAz7FYmH-jO/s320/google-authenticator-www.hackthesec.co.in.png" width="179" /></a></div>
<span style="background-color: white; font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;"><br /></span>
<span style="background-color: white; font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;"><br /></span>
<span style="background-color: white; font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">First of all we will install the open source <b>Google Authenticator PAM module</b> by executing the following command on the shell.</span><br />
<div style="background-color: white;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"><span style="color: white;">yum install </span><span style="color: lime;">google-authenticator</span></span></span></pre>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">This command will install Google authenticator on you <a href="http://www.hackthesec.co.in/search/label/centos7" target="_blank">Centos 7</a> Server. The next step is to get the verification code. It's a very simple command to get the verification code and scratch codes by just answering simple questions of server which he will ask you. You can do that step by running the following command:</span></div>
<div style="font-family: Verdana, Geneva, sans-serif; line-height: 19.2px;">
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); line-height: normal; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: cyan; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">google-authenticator</span></span></pre>
<div style="font-size: 12px;">
<span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;"><br /></span></span></div>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">You will get an output like the following screenshot which is being displayed to help you step by step as this step is very important and crucial. Write down the emergency scratch codes somewhere safe, they can only be used one time each, and they're intended for use if you lose your phone.</span></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;"><br /></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRa0sksNiUe3yuPtSYG_BLap7nPIgsV6_P0q-6kVhQCFK3dChx6VkIRhdC-C-WIE1RQCHRQVm5H8NVrwtwGfpfH1htsLoIRq58e8IS9GhJE9NCXnFJJoPj6AWfRKTKfa9IMZSthekDMbzE/s1600/ssh_two_factor_authentication-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRa0sksNiUe3yuPtSYG_BLap7nPIgsV6_P0q-6kVhQCFK3dChx6VkIRhdC-C-WIE1RQCHRQVm5H8NVrwtwGfpfH1htsLoIRq58e8IS9GhJE9NCXnFJJoPj6AWfRKTKfa9IMZSthekDMbzE/s1600/ssh_two_factor_authentication-www.hackthesec.co.in.jpg" /></a></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<div style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px; padding: 1em;">
Now download Google authenticator application on your Mobile phone, the app exists for Android and Iphone. Well I have Android so I will download it from Google Play Store where I searched it out just by typing "<b>google authenticator</b>".</div>
<div style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px; padding: 1em;">
The next step is to change some files which we will start by first changing<b> /etc/pam.d/sshd</b>. Add the following line to the bottom of line:</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"><span style="color: white;">auth required pam_</span><span style="color: lime;">google_authenticator.so</span></span></span></pre>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="color: white; font-family: Courier New, Courier, monospace;"><span style="line-height: 15.6px;"><br /></span></span></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFXc2rN8O_YBWlLUgUrTPMcjlPm0Pa6x27jFRvQH1STaXipAVhisNBIQzJwSDiNJPkM5ALSbNj4y2JnOgHxe3zsimBEAVGyT0mpZ8YoN6pYGryQy6lCTtmylqK_dAnFLYkuX95JSIop3sm/s1600/ssh_two_factor_authentication2-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFXc2rN8O_YBWlLUgUrTPMcjlPm0Pa6x27jFRvQH1STaXipAVhisNBIQzJwSDiNJPkM5ALSbNj4y2JnOgHxe3zsimBEAVGyT0mpZ8YoN6pYGryQy6lCTtmylqK_dAnFLYkuX95JSIop3sm/s1600/ssh_two_factor_authentication2-www.hackthesec.co.in.jpg" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">Change the next file which is <b>/etc/ssh/sshd_config</b>. Add the following line in the file and if its already placed then change the parameter to "yes":</span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"><span style="color: orange;">ChallengeResponseAuthentication </span><span style="color: white;">yes</span></span></span></pre>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikQFBGqygMhqOpxkF1AXZFqfPYK6kcwT7Y5xtZTdk5ulwiYnmpAKpDBkMDvAGUX2-YGvZEAJzWxqtgRd8A9ypImFboal5LMOVzXgFy_sl-4UY5ZJrVFyuSCTnr7bggeQRKen21a0hARb9d/s1600/ssh_two_factor_authentication3-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikQFBGqygMhqOpxkF1AXZFqfPYK6kcwT7Y5xtZTdk5ulwiYnmpAKpDBkMDvAGUX2-YGvZEAJzWxqtgRd8A9ypImFboal5LMOVzXgFy_sl-4UY5ZJrVFyuSCTnr7bggeQRKen21a0hARb9d/s1600/ssh_two_factor_authentication3-www.hackthesec.co.in.jpg" /></a></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;"><br /></span></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">Now restart the service of ssh by the following command:<br /></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"><span style="color: white;">service </span><span style="color: lime;">sshd </span><span style="color: white;">restart</span></span></span></pre>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">Last step is to test the service by connecting with SSH to the server to see if it will require verification code. You can see the following screenshot which shows the verification code(FROM MY ANDROID MOBILE GOOGLE Authenticator App) that keeps on changing time after time and you have to login with it:<br /></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0tnpXl0xAoWwlvo_-z-iAjWKzq_e7glfjo3Ceoi21oQEVkJg9UlsPgbjpkV8wO0-cc72gKjfsQelCwyN3PrbeMXws80lVqEwHmQ3Dkb7TqdHfN9kI4QxtG1Dl5wY8e5cuj2xzm3lvEHW2/s1600/ssh_two_factor_authentication4-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0tnpXl0xAoWwlvo_-z-iAjWKzq_e7glfjo3Ceoi21oQEVkJg9UlsPgbjpkV8wO0-cc72gKjfsQelCwyN3PrbeMXws80lVqEwHmQ3Dkb7TqdHfN9kI4QxtG1Dl5wY8e5cuj2xzm3lvEHW2/s1600/ssh_two_factor_authentication4-www.hackthesec.co.in.jpg" /></a></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;"><br /></span></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<span style="font-family: Tahoma, Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17.92px;">So we have successfully configured SSH authentication based on <b>Google Authenticator</b>. Now your <b>SSH </b>is secure and no brute attack can invade your server unless someone has your verification code which will require access to your phone as well.</span></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;">
<br /><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>
</div>

Secure SSH with Google Authenticator Two-Factor Authentication on CentOS 7

Google Authenticator Two-Factor Authentication on CentOS 7 SSH access is always critical and you might want to find ways to improve the security of your SSH access. In this article we will see how we…

26 Feb 2016

How To Protect SSH/FTP using Fail2ban on CentOS/RHEL

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="background-color: white; border: 0px; color: #555555; font-family: 'Roboto Slab'; font-size: 16px; font-weight: 700; line-height: 28px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"></span><br />
<h2 class="title single-title title20" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 28px; line-height: 38px; margin: 0px 0px 5px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #990000;">Protect SSH/FTP using Fail2ban on <span style="color: #990000;"><a href="http://www.hackthesec.co.in/search/label/Centos" target="_blank">CentOS</a>/<a href="http://www.hackthesec.co.in/search/label/RHEL" target="_blank">RHEL</a></span></span></h2>
<div>
<br /></div>
<span style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; font-weight: 700; line-height: 28px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Fail2ban</span><span style="background-color: white; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px;"> is very useful application for you, if you are managing security of server, or you are running your own vps or physical server. Fail2ban scan log files created on system and has ability to ban ips which found malicious bassed on configuration rules. We can use it for monitoring various system services logs like Apache, SSH and blog the ips which are trying to breach the system’s security.</span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvYwtsMX3Bq2_cXxy4niiEgIqf37zBT4OxmPthki2VDo-2_0ZGme6o8Dh9MCx8WbtvpA4_X4oExHdUqhEhJyd4273kHqF-JYwU3ulTphv8qzTenWsVnqudq6s8eqXAhMzZesm-wnqwqIUw/s1600/fail2ban-on-centos_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvYwtsMX3Bq2_cXxy4niiEgIqf37zBT4OxmPthki2VDo-2_0ZGme6o8Dh9MCx8WbtvpA4_X4oExHdUqhEhJyd4273kHqF-JYwU3ulTphv8qzTenWsVnqudq6s8eqXAhMzZesm-wnqwqIUw/s640/fail2ban-on-centos_www.hackthesec.co.in.jpg" width="640" /></a></div>
<span style="background-color: white; color: #0b5394; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px;"><br /></span>
<span style="background-color: white; color: #0b5394; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px;">Step 1: Install EPEL RPM Repository</span><br />
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="font-size: large;"><span style="line-height: 28px;">Fail2ban is available in <a href="http://www.hackthesec.co.in/2016/01/how-to-install-epel-repo-on-centos-and.html" target="_blank">EPEL</a> repository, So make sure you have installed <a href="http://www.hackthesec.co.in/2016/01/how-to-install-epel-repo-on-centos-and.html" target="_blank">EPEL</a> repository in your system or you can use </span><a href="http://www.hackthesec.co.in/2016/01/how-to-install-epel-repo-on-centos-and.html" style="line-height: 28px; outline: none; text-decoration: none;" target="_blank">these instructions</a><span style="line-height: 28px;"> to install it.</span></span></div>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="line-height: 28px;"><br /></span><span style="font-size: 24px; font-weight: bolder; line-height: 34px;"><span style="color: #0b5394;">Step 2: Install Fail2ban Package</span></span></div>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
After installing required repository use yum package manager to install Fail2ban rpm package using following command.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># yum install fail2ban<span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 3: Setup Fail2ban Default Configuration</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
Fail2ban provides its own security configuration file <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">/etc/fail2ban/jail.conf</span>, but we need to create a copy of this file as <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">jail.local</span>.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local<span style="font-size: 0.9em;">
</span></pre>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
Now we need to make necessory changes in jail.local file to create ban rules. Edit this file in your favorite editor and make changes in <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">[DEFAULT]</span> section.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will use as always allowed, 
# so add your system ip to protect your ip from banned.
<orange style="color: orange;">ignoreip = 127.0.0.1/8 192.168.1.0/24 11.22.33.44</orange>

# "bantime" is the total number of seconds that a host is banned (3600sec = 1 Hour ).
<orange style="color: orange;">bantime  = 3600</orange>

# A host is banned if it has generated "maxretry" during the last "findtime" seconds. as per below 
# settings, 2 minutes
<orange style="color: orange;">findtime  = 120</orange>

# "maxretry" is the number of failures before a host get banned.
<orange style="color: orange;">maxretry = 3 </orange><span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 4: Protect SSH/SFTP</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
After completing default configuration, go down in the same file jail.local and update <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">[ssh-iptables]</span> section as below.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=22, protocol=tcp]
           sendmail-whois[name=SSH, dest=root, sender=admin@hackthesec.co.in, sendername="Fail2Ban"]
logpath  = /var/log/secure
maxretry = 3<span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 5: Protect FTP (vsFTPd) Server</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
Let’s protect your FTP (vsFTPd) server, Find the below entry of <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">[vsftpd-iptables]</span> section and make changes as below. If you are not using vsFTPd, you can skip this section.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">[vsftpd-iptables]

enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=21, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=admin@hackthesec.co.in]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 1800<span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 6: Restart Fail2ban Service</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
After making all the changes save your file and restart Fail2ban service using following command.</div>
<br />
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
</div>
<div class="single-post-ad" style="background-color: white; border: 0px; clear: both; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin: 0px 0px 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
</div>
<br />
<pre style="-webkit-text-stroke-width: 0px; background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 1.3em; margin: 0px 0px 20px; orphans: auto; outline: 0px; overflow: auto; padding: 20px; text-align: start; text-indent: 0px; text-transform: none; vertical-align: baseline; widows: 1; word-spacing: 0px;"># service fail2ban restart
# chkconfig fail2ban on<span style="font-size: 0.9em;">
</span></pre>
<pre style="-webkit-text-stroke-width: 0px; background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 1.3em; margin: 0px 0px 20px; orphans: auto; outline: 0px; overflow: auto; padding: 20px; text-align: start; text-indent: 0px; text-transform: none; vertical-align: baseline; widows: 1; word-spacing: 0px;"><a href="http://www.hackthesec.co.in/" target="_blank">Hack The Security</a>
<a href="https://www.twitter.com/hackthesecurity" target="_blank">Hack The Security Twitter</a>
<a href="http://facebook.com/htsecu" target="_blank">Hack The Security Facebook</a></pre>
</div>

How To Protect SSH/FTP using Fail2ban on CentOS/RHEL

Protect SSH/FTP using Fail2ban on CentOS/RHEL Fail2ban is very useful application for you, if you are managing security of server, or you are running your own vps or physical server. Fail2ban scan lo…

28 Jan 2016

Load more posts