There are several things you can do to secure and secure your SSH. One is to use Google Authenticator to creating two-factor authentication on your CentOS. Google Authenticator adds an extra layer of security by creating time-based one-time passwords (TOTP) on your smartphone so you can log in with your name and password to log into the server via SSH.
In today’s blog post, we’ll walk you through how to install Google Authenticator from source and set up SSH for two-factor authentication…
First of all, update your CentOS virtual server
yum -y update
Then install the ‘pam-devel’ package, which allows you to set the authentication policy without recompiling the programs that handle the authentication.
yum -y install pam-devel
Make sure ntpd is installed and running as TOTP security tokens are time sensitive
yum -y install ntp /etc/init.d/ntpd start chkconfig ntpd on
Download and unzip the Google Authenticator package
cd /opt/ wget https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2 tar -xvzf libpam-google-authenticator-1.0-source.tar.bz2 cd libpam-google-authenticator-1.0
Compile and install the Google Authenticator module
make make install
Now run Google Authenticator on your server and answer each of the questions
google-authenticator Do you want authentication tokens to be time-based (y/n) y https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/[email protected]%3Fsecret%3DWYJ4YCGEE3N4M3MA Your new secret key is: WVD4YAGEE5N9M3LA Your verification code is 198227 Your emergency scratch codes are: 40084389 29917071 85501143 61878576 90392562 Do you want me to update your "/root/.google_authenticator" file (y/n) y Do you want to disallow multiple uses of the same authentication token? This restricts you to one login about every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) y By default, tokens are good for 30 seconds and in order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. If you experience problems with poor time synchronization, you can increase the window from its default size of 1:30min to about 4min. Do you want to do so (y/n) y If the computer that you are logging into isn't hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting (y/n) y
Open the URL after answering the first question asked and scan the QR code using the Google Authenticator app on your smartphone.
That’s all! A new verification code will be generated every 30 seconds.
Now you will need to enable Google Authenticator for SSH login. Open PAM’s config file
And add the following line at the top
auth required pam_google_authenticator.so
Open the SSH configuration file and make sure the ‘ChallengeResponseAuthentication’ line is set to yes.
Save your changes and restart the SSH service:
service sshd restart
Now, every time you try to log into your server using SSH, you will be prompted to enter the verification code displayed in the Google Authenticator app.
login as: Verification code: Password:
PS. If you liked this post, please share it with your friends on social networks using the buttons on the left side of the post, or just leave a comment below. Thank you in advance.