We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I know, is to modify open-ssh client, and, another is to develop a PAM(Pluggable authentication module) module.

Are there other ways? Which is the best method considering easy deployment (note: complexity of development is not concern)? The authentication will be used mainly by server's ssh daemon to authenticate users for log in.

  • You can try using challenge OTP by giving each user a device with a registered seed,
    – Arun
    Apr 15, 2013 at 6:57
  • Solution specific to ssh can be considered as well. Keeping the ssh tag. Apr 15, 2013 at 7:43
  • @Arun, we have already seed, challenge and verification implemented. Question is now, which is the best way to integrate them with ssh daemon for login? Modifying ssh-server or pam? or any other mechanism is better? Apr 15, 2013 at 9:56
  • 1
    OpenSSH now supports multiple authentication methods (you can require several of them) - see openssh.org/txt/release-6.2.
    – peterph
    Apr 15, 2013 at 20:59
  • We are testing logintc these days. It is very elegant and low cost solution (compared to use expensive tokens and OTP solutions). They have a PAM that integrates with RADIUS.
    – user24866
    Apr 16, 2013 at 17:39

5 Answers 5


I am using IPA (LDAP, Kerberos, SSSD) since early 2.x versions and couldn't be happier. With regards to 2FA and OpenSSH, here is the relevant snippet of my sshd_config:

AllowGroups ipausers
GSSAPIAuthentication yes
PasswordAuthentication no
PubkeyAuthentication yes
RequiredAuthentications2 publickey,gssapi-with-mic

As of OpenSSH-6.2, the Red Hat patch implementing the RequiredAuthentications2 has been either included upstream or superseeded:

  • sshd(8): Added support for multiple required authentication in SSH protocol 2 via an AuthenticationMethods option. This option lists one or more comma-separated lists of authentication method names. Successful completion of all the methods in any list is required for authentication to complete. This allows, for example, requiring a user having to authenticate via public key or GSSAPI before they are offered password authentication.
  • What if we are not using IPA but an algorithm to verify tokens generated by devices? How to implement it then without using PAM or modifying ssh-server? Apr 16, 2013 at 5:35
  • It is usually recommended not to implement you own solution, but to stick to known standards and protocols. You have stated in a comment above your concern is simplicity. IPA uses known standards and protocols, is dead simple to use and doesn't require to modify the OpenSSH server, only its configuration. Obviously, PAM is necessary here.
    – dawud
    Apr 16, 2013 at 7:09
  • I'm quite fond of IPA myself, but publickey,gssapi-with-mic is not really 2-factor. Unless you are using hardware tokens to store your ssh private keys (like an OpenPGP-compatible smartcard), your ssh keys are still "something you know" and not "something you have". The main goal of "something you have" is to demonstrate the presence of a device that isn't same as the computer performing the authentication.
    – mricon
    May 2, 2013 at 23:52

Personally, I've always been a big fan of using RADIUS to support two factor authentication. Not sure which make of tokens you have, but I think that the RSA ones integrate pretty nicely with RADIUS, though I've not personally configured such a system before. It's an established standard that should also integrate fairly easily with any serious SSH server.

  • You are suggesting RADIUS as an alternative. Will that require modifying ssh server or only configuring? Apr 16, 2013 at 5:29
  • @Atique - it depends on the server you are using. RADIUS is a standard method of doing third party authentication services though, so it is generally directly supported by any decent SSH server and token system. It most likely would only be a configuration thing. Apr 16, 2013 at 13:16
  • 2
    My only problem with RADIUS is that it's not a very secure protocol. It was designed in the 90's and relies on pre-shared keys and weak hashing to secure the communication between the client and the server. The main recommendation when it comes to securing RADIUS is to actually run it over an IPSec connection. If you aren't doing that, you're vulnerable to a number of security attacks, such as man-in-the-middle.
    – mricon
    May 2, 2013 at 23:56
  • @mricon - that or use it only internal to your network and VLAN the sucker. Definitely worth mentioning that it shouldn't be used directly to exchange credentials on a connection that isn't otherwise protected though. May 3, 2013 at 13:02

Traditionally speaking there are 3 forms of authentication

  1. Something you know
  2. Something you have
  3. Something you are (physical characteristics)

So if you have a token syn device , I'm assuming we are talking about (2), as when i login in to modified ssh server it sends me a pass-phrase which i enter in my hand held device / token device which gets sync with central server and brings me a OTP. I enter this with my original password to login in.

The complexity i see in modifying ssh to authenticate user on two levels and then ensuring no race conditions exists.

  • Complexity is not concern. Concern is easy deployment. For example, installing a PAM is easier. My question is whether any other better way exist? Apr 16, 2013 at 5:28

There are many options for securing SSH access to you systems. Picking something that is based on a standard secure protocol and framework is going to make it easy for you to administer and expand.

PAM is a good option. Check out our service, LoginTC. It's free to try/use.

Two factor authentication with PAM: https://www.logintc.com/docs/connectors/unix-ssh.html.


I highly recommend using a standard network authentication protocol, especially radius. Using radius, you can integrate your directory whether you use ldap or AD, and still proxy an authentication request to a third-party two-factor auth server. You can see how to do this with freeradius/openldap here: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-openldap-and-freeradius (or on NPS: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-nps).

If you want to see how to set up two-factor auth from PAM, Apache, etc, through radius to the directory and on to a third-party server, see eGuide to two-factor auth on this page: http://www.wikidsystems.com/learn-more/white-papers (no reg).

  • We must use the Token Device. RADIUS is not in the solution right now. Still for curiosity I have asked a question in comment of the answer of @AJ Henderson. Apr 16, 2013 at 5:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .