{"id":3497,"date":"2014-04-07T08:45:59","date_gmt":"2014-04-07T13:45:59","guid":{"rendered":"https:\/\/secure.rosehosting.com\/blog\/?p=3497"},"modified":"2022-12-14T10:49:57","modified_gmt":"2022-12-14T16:49:57","slug":"how-to-secure-your-ssh-using-two-step-authentication-on-centos-6","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/how-to-secure-your-ssh-using-two-step-authentication-on-centos-6\/","title":{"rendered":"How to secure your SSH using two-step authentication on CentOS 6"},"content":{"rendered":"
There are several things you can do to secure and protect your SSH. One of them is to use Google Authenticator and create a two-factor authentication on your CentOS VPS<\/a>. Google Authenticator gives you an extra layer of security by generating time based one-time passwords (TOTP) on your smartphone that you must enter along with your username and password in order to login to the server via SSH.<\/p>\n <\/p>\n In today’s blog article we will explain how to install Google Authenticator from source and configure SSH for two-factor authentication.<\/p>\n First of all update your CentOS virtual server<\/p>\n Next, install the ‘pam-devel<\/em>‘ package which allows you to set authentication policies without having to recompile programs that handle authentication.<\/p>\n Make sure that ntpd is installed and running because the TOTP security tokens are time sensitive<\/p>\n Download and unpack the Google authenticator package<\/p>\n Compile and install the Google authenticator module<\/p>\n Now, run the Google authenticator on your server and answer each of the questions<\/p>\n Open the URL given after answering the first question and scan the QR code using the Google Authenticator application on your smartphone. That’s all. A new verification code will be generated every 30 seconds.<\/p>\n Now you will need to enable Google authenticator for SSH logins. Open PAM’s configuration file<\/p>\n And add the following line at the top<\/p>\n Open the SSH configuration file and ensure that the ‘ChallengeResponseAuthentication<\/em>‘ line is set to yes<\/p>\n Save the changes and restart the SSH service:<\/p>\n Now, every time you try to SSH into your server you will be prompted to enter the verification code displayed in your Google Authenticator application.<\/p>\n Of course, if you are one of our Linux VPS Hosting<\/a> customers, you don\u2019t have to do any of this, simply ask our admins, sit back and relax. Our admins will set this up for you immediately. For updates, you can refer to Secure SSH using two-factor authentication on Ubuntu 16.04<\/a>.<\/p>\n PS.<\/span><\/strong> If you liked this post please share it with your friends on the social networks using the buttons on the left or simply leave a reply below. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":" There are several things you can do to secure and protect your SSH. One of them is to use Google … <\/p>\nyum -y update<\/pre>\n
yum -y install pam-devel<\/pre>\n
yum -y install ntp\r\n\/etc\/init.d\/ntpd start\r\nchkconfig ntpd on<\/pre>\n
cd \/opt\/\r\nwget https:\/\/google-authenticator.googlecode.com\/files\/libpam-google-authenticator-1.0-source.tar.bz2\r\ntar -xvzf libpam-google-authenticator-1.0-source.tar.bz2\r\ncd libpam-google-authenticator-1.0<\/pre>\n
make\r\nmake install<\/pre>\n
google-authenticator\r\n\r\nDo you want authentication tokens to be time-based (y\/n) y\r\nhttps:\/\/www.google.com\/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth:\/\/totp\/root@YOURHOSTNAME%3Fsecret%3DWYD4YCGEE5N4M3LA\r\nYour new secret key is: WYD4YCGEE5N4M3LA\r\nYour verification code is 188127\r\nYour emergency scratch codes are:\r\n 60086389\r\n 28918071\r\n 88502143\r\n 60873576\r\n 90892542\r\n\r\nDo you want me to update your \"\/root\/.google_authenticator\" file (y\/n) y\r\n\r\nDo you want to disallow multiple uses of the same authentication\r\ntoken? This restricts you to one login about every 30s, but it increases\r\nyour chances to notice or even prevent man-in-the-middle attacks (y\/n) y\r\n\r\nBy default, tokens are good for 30 seconds and in order to compensate for\r\npossible time-skew between the client and the server, we allow an extra\r\ntoken before and after the current time. If you experience problems with poor\r\ntime synchronization, you can increase the window from its default\r\nsize of 1:30min to about 4min. Do you want to do so (y\/n) y\r\n\r\nIf the computer that you are logging into isn't hardened against brute-force\r\nlogin attempts, you can enable rate-limiting for the authentication module.\r\nBy default, this limits attackers to no more than 3 login attempts every 30s.\r\nDo you want to enable rate-limiting (y\/n) y<\/pre>\n
vi \/etc\/pam.d\/sshd<\/pre>\n
auth required pam_google_authenticator.so<\/pre>\n
ChallengeResponseAuthentication yes<\/pre>\n
service sshd restart<\/pre>\n
login as: \r\nVerification code:\r\nPassword:<\/pre>\n