Two Factor Auth for Unix PAM stack

[ocabj]

We're going to enable two-factor auth ssh logins at work, but I was messing around with Duo Security for Unix on my own VPS and found the Duo Unix PAM module pretty intriguing.

There's a general CLI binary you can compile in the Duo Unix source where sshd can execute the command for auths, but this can technically be bypassed by the users through some crafty .bash_profile/.profile edits. Thus, there's a PAM module for better integration.

What's also cool is that even for those people using passwordless key authentication to ssh in, the second factor requirement will still kick in if configured. Thus, if someone has a stolen laptop/etc or leaves their workstation open, someone else can't just use their key'ed computer to ssh to the target host since sshd will still ask for a second factor (where the private key is the first).

Anyway, the intriguing aspect for this is that you can not only enable two-factor for the Unix system core, but the PAM stacks for other PAM capable applications, e.g. sudo, ksu, sshd via PAM, sftp, etc.

two-factor for sudo seems appealing in that various users are delegated some root level command rights in order to get applications installed, run updates, etc. Although, this seems like it could be overkill in that if the non-root user already two-factor'ed to shell into the system, then does another two-factor for the sudo'ed command, does this really accomplish anything short of auditing (where sudo already has auditing built-in; assuming you have sane system log configurations).

Anyone else using two-factor in their Unix environments?

[yellowsulphur]

I've experimented with Google two-factor authentication for an sftp server (old laptop) that I primarily used for remote storage with my chromebook while on the go. This was of course not enterprise level stuff, but just for me. The downside with this system is that you need something android to run the authenticator to generate a token that changes every 30 seconds. This is the same two-factor authentication that gmail uses.

https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication

[speedrrracer]

Anyone else using two-factor in their Unix environments?

Heck yes, and we ended up with Duo Security, too. And it's so much cheaper and easier to implement nowadays it blows my mind compared to the hoops we used to have to jump through.

My first experience with two-factor across the board was in '98, and it was like moving mountains, and cost us a fortune. Now, it's something you can toss in as an "oh, yeah" in your garage start-up.

[ocabj]

I was using Google Authenticator for a while, before we got Duo at work. Since the Duo Mobile app does TOTP, I just uninstalled Google Authenticator app and use the Duo Mobile app for all my Duo Security based two-factor, and my TOTP two-factor services.

Google Authenticator is sufficient for personal use, but even then, Duo is 'free' for personal use, and you still get Duo Push along with TOTP, and a limited number of SMS and phone call two-factor sessions.

At work, we've been using Duo for CAS (jasig) for awhile, but with a limited user base. All of our campus webapps that are centrally managed are all CAS SSO.

We're going to go wide with two-factor for CAS, but are now going Duo with regards to other infrastructure (e.g. core Unix, core Windows RDP, and most likely Anyconnect). But the Duo Unix integration is something we haven't messed around with as a group/department, yet.

[yellowsulphur]

I created a "just me" account with Duo Security to see what I can learn. I'll do some research and see if I can implement this on my router which is running Debian on a MIPS architecture. Right now I have SSH open to the WAN on a port other than 22 which isn't great. My main need to SSH to the router is to send magic packets to wake systems on the network.