Integrating Google Authenticator with SSH logins
Best Laid Plans
The Google Authenticator PAM module allows you to use time-based Google Authenticator passwords with various Linux services, including SSH.
In recent years, multifactor authentication (MFA) has been a hot topic in information security, with many organizations and software services now making it a requirement. To achieve MFA, two or more authentication factors must be provided by a user to pass authentication. These factors include something you have, something you know, something you are, somewhere you are, or something you do.
Many organizations have turned to the Google Authenticator tool to implement MFA using a time-based one-time password (TOTP). Using TOTP with Google Authenticator satisfies the "something you have" authentication factor because TOTP requires a device in the user's possession (e.g., the user's Android smartphone or iPhone.) Adding a regular user password to satisfy the "something you know" authentication factor provides the second factor to achieve MFA. Many software as a service (SaaS) providers, such as GitHub, AWS, and Microsoft Azure, support Google Authenticator as an option for MFA.
At a high level, TOTP works by having a secret key that is generated on a service and shared with a device. The TOTP algorithm with two inputs, the secret key plus the system's Unix time, results in a one-time password known by both the device and the service. A new password is typically generated every 30 or 60 seconds.
Google provides a pluggable authentication module (PAM), google-authenticator-libpam
[1], that system administrators can use to integrate various Linux services with Google Authenticator. As a PAM module, it can be used with virtually any Linux service with robust industry-standard authentication methods. In this article, I will specifically integrate Google Authenticator with SSH logins.
Advantages of MFA with SSH
You will find MFA useful on servers that have SSH open to the entire Internet or have SSH open to large networks. By adding MFA to SSH, you can mitigate brute-force attacks on SSH servers, as well as lower the impact of user password leaks. An attacker would need both the user's password and access to the user's Android or iPhone device (or their Google Authenticator secret key) to gain access to their user account on a server via SSH.
Typically, SSH brute-force attacks on the open Internet are dictionary password attacks, and adding TOTP will negate this type of attack. However, if a password leak is suspected, or a user password seems to have been discovered by an attacker, it is necessary to change the password regardless of whether MFA has been implemented or not.
Considerations
While MFA does provide additional security benefits for authentication with SSH, it does not make sense for all use cases. Bastion hosts, which are typically accessed manually by users or as a jump host, are usually good use cases for MFA. However, MFA may not be ideal for internal SSH hosts located behind a bastion jump host, because two separate MFA codes will be required for both the bastion jump host and the destination server. This could cause some confusion for users on login. If a bastion host configured with MFA is the only SSH server on the network with Internet access, then SSH hosts that are only accessible internally could be considered sufficiently secure with normal password or key authentication.
Large server environments primarily managed with Ansible instead of manual SSH user access pose another problem to using MFA. Ansible relies on SSH to manage configurations on servers. Having separate time-based passwords for each host SSH login during an Ansible playbook run could be cumbersome, even unfeasible, for large server environments.
Installation
The Google Authenticator module requires libqrencode
as a dependency for generating QR codes in a shell session. On Ubuntu Server 22.04, libqrencode
can be installed with:
# apt install libpam-google-authenticatorlibqrencode4
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Gnome 47.2 Now Available
Gnome 47.2 is now available for general use but don't expect much in the way of newness, as this is all about improvements and bug fixes.
-
Latest Cinnamon Desktop Releases with a Bold New Look
Just in time for the holidays, the developer of the Cinnamon desktop has shipped a new release to help spice up your eggnog with new features and a new look.
-
Armbian 24.11 Released with Expanded Hardware Support
If you've been waiting for Armbian to support OrangePi 5 Max and Radxa ROCK 5B+, the wait is over.
-
SUSE Renames Several Products for Better Name Recognition
SUSE has been a very powerful player in the European market, but it knows it must branch out to gain serious traction. Will a name change do the trick?
-
ESET Discovers New Linux Malware
WolfsBane is an all-in-one malware that has hit the Linux operating system and includes a dropper, a launcher, and a backdoor.
-
New Linux Kernel Patch Allows Forcing a CPU Mitigation
Even when CPU mitigations can consume precious CPU cycles, it might not be a bad idea to allow users to enable them, even if your machine isn't vulnerable.
-
Red Hat Enterprise Linux 9.5 Released
Notify your friends, loved ones, and colleagues that the latest version of RHEL is available with plenty of enhancements.
-
Linux Sees Massive Performance Increase from a Single Line of Code
With one line of code, Intel was able to increase the performance of the Linux kernel by 4,000 percent.
-
Fedora KDE Approved as an Official Spin
If you prefer the Plasma desktop environment and the Fedora distribution, you're in luck because there's now an official spin that is listed on the same level as the Fedora Workstation edition.
-
New Steam Client Ups the Ante for Linux
The latest release from Steam has some pretty cool tricks up its sleeve.