Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
For SSH authentication, which is more secure?
2 Factor Authentication using a USB token/Google Authenticator(time based)
OR
Public/private key with password
Or could they be both used at the same time? If it is possible, are there any downsides in using a multi-factor authentication like this?
Also, could anyone post an example or a link to show how I could implement both public key and 2 Factor together if it's possible. Thankyou!
This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system:
Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy.
Using 2Factor auth ensures that an attacker would have to get 2 properties under control: one password-mechanism (usual passwords, PK) and another one which is (usually) not at the same physical location as the first one. With 2Factor mode the system you are trying to authenticate against will challenge you a second time after you succeeded at the first challenge. But if both challenges are silly / simple / easy to break the whole 2Factor thingy is pointless.
So, both mechanisms supplement each other.
Good tutorial on the 2Factor part:
Combine that with any other tutorial which explains how to use ssh-keys (and there are LOTS in the internets). The flow of the authentication is then as follows:
In addition to the other answer, I can also add that pubkey-based authentication can be 2-factor in itself if your private key is on a smartcard (e.g. OpenPGP card). In my experience, adding google-authenticator at the ssh level makes admin's life too cumbersome -- you have to enter the code each time you need to scp things around. My preferred approach is ssh key on OpenPGP card and google-authenticator when doing sudo.
These two links will be of use to you:
ControlMaster you will only have to enter once at the beginning of your session (with a given host).
The trade off between how much hassle it is to maintain a two-factor or Public Key authentication and the degree of security each provides depends on how/who is using it. If the usage is among a limited number of server system managers who are familiar with security so that they won't pollute either process by allowing access to their access (PC, laptop, mobile device) to be compromised, then either of these may prove secure.
The various reports, articles and blogs I have read indicate that the most often means of defeating either two-factor authentication or public key encryption is gaining access to insecure client access - a PC left on or without password protection that is used to gain root access (or other areas). Passwords may be stored on the device in a password manager or are automatically put in by a web browser or jotted down on paper in a desk.
Another means of compromise is when passwords and keys are not changed after an employee/associate leaves.
Most brute force, distributed brute force attacks and other outside attacks are effectively thwarted by either two-factor or Public key authentication methods. That is improved if reasonably tough passwords are used and password encrypted public key access is required (a form of two-factor authentication itself).
Other methods may be used, such as using a non-standard SSH port, although there is valid argument against that method. Another method is use of rotating/random non-standard ports or use of Port-knocking in which three or more ports must be sequentially hit/knocked before access is granted to a selected SSH or other ports. The port-knock ports may also be rotated periodically.
The latter methods are not usually justified because it is far more likely that security breaches will occur from within an organization that has implemented two-factor or/and public key authentication methods. If the nature of the work/servers requires the highest levels of security, the additional layers of security may make sense.
I re-watched the movie "The Imitation Game" 2014 last night. It is about the cracking of the Nazi Enigma encryption machine that required determining among some hundreds of millions of possible manual selections. The code was broken by Brit Alen Turing's electromechanical computing machine only after they came upon repeated terms in communications that could be guessed "Heil Hitler!" and other terms in daily weather reports. That goes a long way to describe the security of Linux servers and other secured systems - they are only as secure as the practices of people who use them.
