67 lines
1.8 KiB
Markdown
67 lines
1.8 KiB
Markdown
<header><h1>
|
|
SSH
|
|
</h1></header>
|
|
|
|
# Add TOTP on ssh connection
|
|
For a more secure ssh connection, you can add TOTP (Time-based One-Time Password) to your ssh connection.
|
|
This will require you to enter a password and a TOTP code to connect to your server.
|
|
This is a good way to add an extra layer of security to your server.
|
|
|
|
## Installing Google Authenticator PAM
|
|
```bash
|
|
sudo apt install libpam-google-authenticator
|
|
```
|
|
## Configuring SSHD for Google PAM
|
|
1. Edit the sshd configuration file
|
|
```bash
|
|
sudo nano /etc/pam.d/sshd
|
|
```
|
|
2. Modified the file to look like this
|
|
```bash
|
|
# PAM configuration for the Secure Shell service
|
|
|
|
# Standard Un*x authentication.
|
|
#@include common-auth
|
|
|
|
. . .
|
|
|
|
# Standard Un*x password updating.
|
|
@include common-password
|
|
auth required pam_google_authenticator.so nullok
|
|
```
|
|
Comment out the `@include common-auth` for disable password authentication.
|
|
`nullok` allows users without a TOTP code to connect without one.
|
|
3. Edit the sshd configuration file
|
|
```bash
|
|
sudo nano /etc/ssh/sshd_config
|
|
```
|
|
4. Add the following line to the bottom of the file
|
|
```bash
|
|
. . .
|
|
# Change to yes to enable challenge-response passwords (beware issues with
|
|
# some PAM modules and threads)
|
|
ChallengeResponseAuthentication yes
|
|
. . .
|
|
UsePAM yes
|
|
AuthenticationMethods publickey,password publickey,keyboard-interactive
|
|
. . .
|
|
```
|
|
5. Restart the sshd service
|
|
```bash
|
|
sudo systemctl restart sshd
|
|
```
|
|
|
|
## Generating the Google Authenticator QR Code
|
|
1. Run the following command
|
|
```bash
|
|
google-authenticator
|
|
```
|
|
2. Answer the following questions
|
|
3. Scan the QR code with your Google Authenticator app
|
|
4. Save the emergency scratch codes in a safe place
|
|
5. Restart the sshd service
|
|
```bash
|
|
sudo systemctl restart sshd
|
|
```
|
|
|