is sms two factor authentication possible to add to SSHing into an AWS EC2?

Question

I'd like to know if I can further secure an AWS EC2 stack (in addition to the .pem file and the allowed SSH inbound ip address security-group)

by requiring that an sms authentication code be entered into the terminal in addition to the .pem file from the terminal.

The cell phone that gets the SMS would be my cell phone, therefore no one would be able to SSH in without me knowing.

unless.. someone changed the SMS number to send the code to their own cell phone... but that person would also need the .pem file and and whatever credentials would be required to change the SMS'd phone #.

Answer 1

Yes, there are ways to set up multi-factor auth for ssh. Generally they use HOTP, rather than an sms auth; this is more secure, so it's what you should really prefer anyways.

Answer 2

You can use SMS to SSH into the machine.

The SMS is sent to your mobile phone. So the idea is that you are in the possession of the mobile phone and only you can enter the code and login.

Well, the past showed, that there are attacks in regards to SMS, that is why NIST removed text messages from their digital authentication guideline. The other thing is, that you need to trigger the SMS. So you somehow need to tell the system to send an SMS. Usually you would do this by providing a password, the first factor. However, this does not always work out quite well.

You could use an HOTP or TOTP based smartphone app. So the question is how secure is your smartphone. You see there are several thoughts to take into account to decide if you want light security, medium security or high security.

Answer 3

Yes it is possible. I personally use DUO Security for all my 2FA needs as it can be plugged into many places. Eg. Web logins, SSH, and others.