Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I know, is to modify open-ssh client, and, another is to develop a PAM(Pluggable authentication module) module.

Are there other ways? Which is the best method considering easy deployment (note: complexity of development is not concern)? The authentication will be used mainly by server's ssh daemon to authenticate users for log in.

share|improve this question
    
You can try using challenge OTP by giving each user a device with a registered seed, –  Arun Apr 15 '13 at 6:57
    
Solution specific to ssh can be considered as well. Keeping the ssh tag. –  Atique Apr 15 '13 at 7:43
    
@Arun, we have already seed, challenge and verification implemented. Question is now, which is the best way to integrate them with ssh daemon for login? Modifying ssh-server or pam? or any other mechanism is better? –  Atique Apr 15 '13 at 9:56
1  
OpenSSH now supports multiple authentication methods (you can require several of them) - see openssh.org/txt/release-6.2. –  peterph Apr 15 '13 at 20:59
    
We are testing logintc these days. It is very elegant and low cost solution (compared to use expensive tokens and OTP solutions). They have a PAM that integrates with RADIUS. –  user24866 Apr 16 '13 at 17:39
add comment

5 Answers

Personally, I've always been a big fan of using RADIUS to support two factor authentication. Not sure which make of tokens you have, but I think that the RSA ones integrate pretty nicely with RADIUS, though I've not personally configured such a system before. It's an established standard that should also integrate fairly easily with any serious SSH server.

share|improve this answer
    
You are suggesting RADIUS as an alternative. Will that require modifying ssh server or only configuring? –  Atique Apr 16 '13 at 5:29
    
@Atique - it depends on the server you are using. RADIUS is a standard method of doing third party authentication services though, so it is generally directly supported by any decent SSH server and token system. It most likely would only be a configuration thing. –  AJ Henderson Apr 16 '13 at 13:16
1  
My only problem with RADIUS is that it's not a very secure protocol. It was designed in the 90's and relies on pre-shared keys and weak hashing to secure the communication between the client and the server. The main recommendation when it comes to securing RADIUS is to actually run it over an IPSec connection. If you aren't doing that, you're vulnerable to a number of security attacks, such as man-in-the-middle. –  mricon May 2 '13 at 23:56
    
@mricon - that or use it only internal to your network and VLAN the sucker. Definitely worth mentioning that it shouldn't be used directly to exchange credentials on a connection that isn't otherwise protected though. –  AJ Henderson May 3 '13 at 13:02
add comment

I am using IPA (LDAP, Kerberos, SSSD) since early 2.x versions and couldn't be happier. With regards to 2FA and OpenSSH, here is the relevant snippet of my sshd_config:

AllowGroups ipausers
GSSAPIAuthentication yes
PasswordAuthentication no
PubkeyAuthentication yes
RequiredAuthentications2 publickey,gssapi-with-mic

As of OpenSSH-6.2, the Red Hat patch implementing the RequiredAuthentications2 has been either included upstream or superseeded:

  • sshd(8): Added support for multiple required authentication in SSH protocol 2 via an AuthenticationMethods option. This option lists one or more comma-separated lists of authentication method names. Successful completion of all the methods in any list is required for authentication to complete. This allows, for example, requiring a user having to authenticate via public key or GSSAPI before they are offered password authentication.
share|improve this answer
    
What if we are not using IPA but an algorithm to verify tokens generated by devices? How to implement it then without using PAM or modifying ssh-server? –  Atique Apr 16 '13 at 5:35
    
It is usually recommended not to implement you own solution, but to stick to known standards and protocols. You have stated in a comment above your concern is simplicity. IPA uses known standards and protocols, is dead simple to use and doesn't require to modify the OpenSSH server, only its configuration. Obviously, PAM is necessary here. –  dawud Apr 16 '13 at 7:09
    
I'm quite fond of IPA myself, but publickey,gssapi-with-mic is not really 2-factor. Unless you are using hardware tokens to store your ssh private keys (like an OpenPGP-compatible smartcard), your ssh keys are still "something you know" and not "something you have". The main goal of "something you have" is to demonstrate the presence of a device that isn't same as the computer performing the authentication. –  mricon May 2 '13 at 23:52
add comment

Traditionally speaking there are 3 forms of authentication

  1. Something you know
  2. Something you have
  3. Something you are (physical characteristics)

So if you have a token syn device , I'm assuming we are talking about (2), as when i login in to modified ssh server it sends me a pass-phrase which i enter in my hand held device / token device which gets sync with central server and brings me a OTP. I enter this with my original password to login in.

The complexity i see in modifying ssh to authenticate user on two levels and then ensuring no race conditions exists.

share|improve this answer
    
Complexity is not concern. Concern is easy deployment. For example, installing a PAM is easier. My question is whether any other better way exist? –  Atique Apr 16 '13 at 5:28
add comment

I highly recommend using a standard network authentication protocol, especially radius. Using radius, you can integrate your directory whether you use ldap or AD, and still proxy an authentication request to a third-party two-factor auth server. You can see how to do this with freeradius/openldap here: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-openldap-and-freeradius (or on NPS: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-nps).

If you want to see how to set up two-factor auth from PAM, Apache, etc, through radius to the directory and on to a third-party server, see eGuide to two-factor auth on this page: http://www.wikidsystems.com/www/learn-more/white-papers (no reg).

share|improve this answer
    
We must use the Token Device. RADIUS is not in the solution right now. Still for curiosity I have asked a question in comment of the answer of @AJ Henderson. –  Atique Apr 16 '13 at 5:33
add comment

There are many options for securing SSH access to you systems. Picking something that is based on a standard secure protocol and framework is going to make it easy for you to administer and expand.

PAM is a good option. Check out our service, LoginTC. It's free to try/use.

Two factor authentication with PAM: https://www.logintc.com/docs/connectors/unix-ssh.html.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.