0

I'd like to know if I can further secure an AWS EC2 stack (in addition to the .pem file and the allowed SSH inbound ip address security-group)

by requiring that an sms authentication code be entered into the terminal in addition to the .pem file from the terminal.

The cell phone that gets the SMS would be my cell phone, therefore no one would be able to SSH in without me knowing.

unless.. someone changed the SMS number to send the code to their own cell phone... but that person would also need the .pem file and and whatever credentials would be required to change the SMS'd phone #.

3 Answers 3

1

Yes, there are ways to set up multi-factor auth for ssh. Generally they use HOTP, rather than an sms auth; this is more secure, so it's what you should really prefer anyways.

3
  • On my servers, I use Google Auth to generate the tokens. It's very easy to implement, and very effective.
    – ThoriumBR
    Feb 10, 2017 at 11:31
  • thanks for the response. the link looks pretty dense, so i can mark this as the accepted answer once i'm able to implement this... may take me a little bit. Feb 11, 2017 at 4:13
  • Google Auth rocks! and the tutorial you included was very easy to follow. Thanks a bunch Feb 11, 2017 at 16:49
0

You can use SMS to SSH into the machine.

The SMS is sent to your mobile phone. So the idea is that you are in the possession of the mobile phone and only you can enter the code and login.

Well, the past showed, that there are attacks in regards to SMS, that is why NIST removed text messages from their digital authentication guideline. The other thing is, that you need to trigger the SMS. So you somehow need to tell the system to send an SMS. Usually you would do this by providing a password, the first factor. However, this does not always work out quite well.

You could use an HOTP or TOTP based smartphone app. So the question is how secure is your smartphone. You see there are several thoughts to take into account to decide if you want light security, medium security or high security.

0

Yes it is possible. I personally use DUO Security for all my 2FA needs as it can be plugged into many places. Eg. Web logins, SSH, and others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.