CentosSSH uses Google Authenticator for secondary verification

Components required for CentOS installation:

1

yum -y install mercurial pam-devel

Install Google Authenticator:

123456

#http://www.haiyun.mewget --no-check-certificate https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2tar jxvf libpam-google-authenticator-1.0-source.tar.bz2 cd libpam-google-authenticator-1.0makemake install

Call the google-authenticator module during SSH logon. Edit:

1

/etc/pam.d/sshd

Add the following in the first line:

1

auth       required     pam_google_authenticator.so

Modify the SSH configuration file:

1

vim /etc/ssh/sshd_config

Add or modify the following content:

12

ChallengeResponseAuthentication yesUsePAM yes

Restart SSH:

1

/etc/init.d/sshd restart

Generate google-authenticator configuration and run:

123456789101112131415161718192021222324252627282930

Google-authenticator Do you want authentication tokens to be time-based (y/n) y https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@node1.www.haiyun.me%3Fsecret%3DABEXG5K6CVB56BXY# This URL is the generated QR code. The client scans Your new secret key is: www. haiyun. meYour verification code is 582849 Your emergency scratch codes are: 30776626 14200155 80795568 23936997 21919909 # the above lines of numbers are emergency codes Do you want me to update your "/root /. google_authenticator "file (y/n) y # update the configuration file Do you want to disallow multiple uses of the same authenticationtoken? This restricts you to one login about every 30 s, but it increasesyour chances to notice or even prevent man-in-the-middle attacks (y/n) y # Do not use a single password By default. tokens are good for 30 seconds and in order to compensate forpossible time-skew between the client and the server, we allow an extratoken before and after the current time. if you experience problems with poortime synchronization, you can increase the window from its defaultsize of 1: 30 min to about 4 min. do you want to do so (y/n) n # Time Difference between the client and the server If the computer that you are logging into isn' t hardened against brute-forcelogin attempts, you can enable rate-limiting for the authentication module. by default, this limits attackers to no more than 3 login attempts every 30s. do you want to enable rate-limiting (y/n) y # frequency limit

Install the google-authenticator client on Android and scan the QR code at the URL above. After you log on to the server, enter the account and password, and enter the verification code generated by google-authenticator to log on.

123

ssh www.haiyun.meVerification code: Password: