Which SSH security is stronger? 2 Factor or Public key

Question

For SSH authentication, which is more secure?
2 Factor Authentication using a USB token/Google Authenticator(time based)
OR
Public/private key with password

Or could they be both used at the same time? If it is possible, are there any downsides in using a multi-factor authentication like this?

Also, could anyone post an example or a link to show how I could implement both public key and 2 Factor together if it's possible. Thankyou!

Answer 1

This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system:

• Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy.

• Using 2Factor auth ensures that an attacker would have to get 2 properties under control: one password-mechanism (usual passwords, PK) and another one which is (usually) not at the same physical location as the first one. With 2Factor mode the system you are trying to authenticate against will challenge you a second time after you succeeded at the first challenge. But if both challenges are silly / simple / easy to break the whole 2Factor thingy is pointless.

So, both mechanisms supplement each other.

Good tutorial on the 2Factor part:

http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/

Combine that with any other tutorial which explains how to use ssh-keys (and there are LOTS in the internets). The flow of the authentication is then as follows:

1. Client triggers mechanism to unlock the private ssh-key (password) on his machine
2. Client contacts Server to ensure public and private key match. From here on the ssh-server is basically not involved in the authentification any more.
3. Server routes Client to the second challenge
4. Client responds to the second challenge correctly
5. Client gets access to the shell on the Server

Answer 2

In addition to the other answer, I can also add that pubkey-based authentication can be 2-factor in itself if your private key is on a smartcard (e.g. OpenPGP card). In my experience, adding google-authenticator at the ssh level makes admin's life too cumbersome -- you have to enter the code each time you need to scp things around. My preferred approach is ssh key on OpenPGP card and google-authenticator when doing sudo.

These two links will be of use to you:

1. Setting up OpenPGP card to handle your ssh authentication.
2. Setting up centralized google-authenticator infrastructure.