Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently acquired a Synology NAS (DS1513+).

I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the options that exist.

Please note, I am aware of the PAM-based Google Auth module but wanted to know if there are alternative approaches.

share|improve this question
    
What's wrong with PAM-based 2FA? Anyway, instead of PAM-based 2FA, you can use the ForceCommand in sshd_config to introduce your own 2FA script after password authentication. It can be as simple as sending a random string to the user's email (or phone number as SMS) and then checking for it before spawning a shell. –  Adnan Feb 26 at 3:30
    
@Adnan I think the question was worded awkwardly. I more wanted to know what other alternatives there were in general to Google Authenticator, be they PAM-based or otherwise. –  speedRS Feb 26 at 5:40

1 Answer 1

up vote 4 down vote accepted

Yes, there's a PAM module for just about everything. You pick your auth token, there's a PAM module for it. SecurID, Yubikey, Text Message, you name it. And yes, also TOTP (e.g. Google Authenticator, Microsoft Authenticator, etc)

If you're looking for doing authentication somewhere other than PAM, then perhaps you should re-evaluate your goals. They call it Pluggable Authentication Modules for a reason. That's exactly where authentication should happen.

share|improve this answer
    
Out of curiosity for the TOTP options you mention, are they reliant on connectivity with Google, for instance. For instance, if I wanted to have TOTP just on my internal network with no WAN connectivity, is that doable or are Google/MS involved at some point during the initial setup process (ie. generating the 2D barcode, etc)? –  speedRS Feb 26 at 5:52
1  
@speedRS No. Go read the spec. –  tylerl Feb 26 at 5:57
    
Will do. Thanks for your comments. –  speedRS Feb 26 at 6:02
    
    
The google-authenticator PAM module works fine with OpenSSH, it's self-contained (no Google servers involved). If you're using it with a TOTP token though, note it has a hard-coded timestep of 30s which may need to be modified (some use 60s). –  mr.spuratic Feb 26 at 15:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.