CentOS 7 SSH 2FA

最近剛好有2次驗證的需求，在此紀錄一下 (使用SSH KEY+Google 2FA 認證登入)

1.安裝google-authenticator套件
2.產生OTP設定檔
3.修改pam.d
4.修改sshd

1.安裝google-authenticator套件

#yum -y install epel-release

#yum -y install google-authenticator

2.產生OTP設定檔

#google-authenticator

Do you want authentication tokens to be time-based (y/n)y
省略(掃描qr code)
Your new secret key is: JUXPJXXXXXXXXXXXXXXXXXXX
#或者是直接把secret key輸入到authy桌面版本
Your verification code is XXXXXXX
Your emergency scratch codes are:
  6XXXXX57
  6XXXXX46
  8XXXXX64
  3XXXXX95
  6XXXXX89
Do you want me to update your "/root/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) n

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) n

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y

3.修改pam.d

#vi /etc/pam.d/sshd

#關閉密碼登錄
#auth       substack     password-auth
#加入二次驗證
auth required pam_google_authenticator.so

4.修改sshd

#vi /etc/pam.d/sshd

UsePAM yes
ChallengeResponseAuthentication yes
#若需要指定使用者進行二次驗證，則可加入Match User
Match User root,fredwei
AuthenticationMethods publickey,password publickey,keyboard-interactive
Match All
Subsystem       sftp    /usr/libexec/openssh/sftp-server

重新啟動SSH服務

#systemctl restart sshd