Google Authenticator OpenSource

The Google Authenticator project includes implementations of one-time passcode generators for several mobile platforms. One-time passcodes are generated using open standards developed by the Initiative for Open Authentication (OATH) (which is unrelated to OAuth).

How to use Google authenticator to protect ssh login

1. Install google authenticator

   apt-get install libpam-google-authenticator
   
   
   
   or
   
   apt-get -y install libpam0g-dev libtool
   
   git clone https://github.com/google/google-authenticator.git
   
   a./bootstrap.sh
   
   ./configure
   
   make
   
   make install
2. Run Google Authenticator

   google-authenticator
   
   Do you want authentication tokens to be time-based (y/n) y

   And then appear two-dimensional code, use the phone side Google Authenticator scan code, then the server-side to continue to set
   If you do not see a two-dimensional code, you can copy the prompt at https://www.google.com/chart? to the browser, you can see the two-dimensional code

   Do you want me to update your "/root/.google_authenticator" file (y/n) y
   
   
   
   Do you want to disallow multiple uses of the same authentication
   
   token? This restricts you to one login about every 30s, but it increases
   
   your chances to notice or even prevent man-in-the-middle attacks (y/n) Do you want to disallow multiple uses of the same authentication
   
   token? This restricts you to one login about every 30s, but it increases
   
   your chances to notice or even prevent man-in-the-middle attacks (y/n) y
   
   
   
   By default, tokens are good for 30 seconds and in order to compensate for
   
   possible time-skew between the client and the server, we allow an extra
   
   token before and after the current time. If you experience problems with poor
   
   time synchronization, you can increase the window from its default
   
   size of 1:30min to about 4min. Do you want to do so (y/n) y
   
   
   
   If the computer that you are logging into isn't hardened against brute-force
   
   login attempts, you can enable rate-limiting for the authentication module.
   
   By default, this limits attackers to no more than 3 login attempts every 30s.
   
   Do you want to enable rate-limiting (y/n) y

    

3. Configure Google Authenticator authentication to SSH login

   Edit the /etc/pam.d/sshd file and add

   auth required pam_google_authenticator.so

   Edit /etc/ssh/sshd_config

   ChallengeResponseAuthentication no => ChallengeResponseAuthentication yes

4. Restart ssh service
   

   service ssh restart
5. Enjoy

   login as: root
   
   Using keyboard-interactive authentication.
   
   Verification code:
   
   Using keyboard-interactive authentication.
   
   Password:
   
   Welcome to Ubuntu 14.04.2 LTS (GNU/Linux 2.6.32-042stab108.8 i686)
   
   
   
   * Documentation: https://help.ubuntu.com/
   
   Last login: Thu Sep 09 09:04:20 2017 from 113.12.206.9