CentosSSH uses Google Authenticator for secondary verification

Source: Internet
Author: User

Components required for CentOS installation:

1
yum -y install mercurial pam-devel

Install Google Authenticator:
123456
#http://www.haiyun.mewget --no-check-certificate https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2tar jxvf libpam-google-authenticator-1.0-source.tar.bz2 cd libpam-google-authenticator-1.0makemake install

Call the google-authenticator module during SSH logon. Edit:
1
/etc/pam.d/sshd

Add the following in the first line:
1
auth       required     pam_google_authenticator.so

Modify the SSH configuration file:
1
vim /etc/ssh/sshd_config

Add or modify the following content:
12
ChallengeResponseAuthentication yesUsePAM yes

Restart SSH:
1
/etc/init.d/sshd restart

Generate google-authenticator configuration and run:
123456789101112131415161718192021222324252627282930
Google-authenticator Do you want authentication tokens to be time-based (y/n) y https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@node1.www.haiyun.me%3Fsecret%3DABEXG5K6CVB56BXY# This URL is the generated QR code. The client scans Your new secret key is: www. haiyun. meYour verification code is 582849 Your emergency scratch codes are: 30776626 14200155 80795568 23936997 21919909 # the above lines of numbers are emergency codes Do you want me to update your "/root /. google_authenticator "file (y/n) y # update the configuration file Do you want to disallow multiple uses of the same authenticationtoken? This restricts you to one login about every 30 s, but it increasesyour chances to notice or even prevent man-in-the-middle attacks (y/n) y # Do not use a single password By default. tokens are good for 30 seconds and in order to compensate forpossible time-skew between the client and the server, we allow an extratoken before and after the current time. if you experience problems with poortime synchronization, you can increase the window from its defaultsize of 1: 30 min to about 4 min. do you want to do so (y/n) n # Time Difference between the client and the server If the computer that you are logging into isn' t hardened against brute-forcelogin attempts, you can enable rate-limiting for the authentication module. by default, this limits attackers to no more than 3 login attempts every 30s. do you want to enable rate-limiting (y/n) y # frequency limit

Install the google-authenticator client on Android and scan the QR code at the URL above. After you log on to the server, enter the account and password, and enter the verification code generated by google-authenticator to log on.
123
ssh www.haiyun.meVerification code: Password:

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.