I recently acquired a Synology NAS (DS1513+).

I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the options that exist.

Please note, I am aware of the PAM-based Google Auth module but wanted to know if there are alternative approaches.

  • What's wrong with PAM-based 2FA? Anyway, instead of PAM-based 2FA, you can use the ForceCommand in sshd_config to introduce your own 2FA script after password authentication. It can be as simple as sending a random string to the user's email (or phone number as SMS) and then checking for it before spawning a shell. – Adi Feb 26 '14 at 3:30
  • @Adnan I think the question was worded awkwardly. I more wanted to know what other alternatives there were in general to Google Authenticator, be they PAM-based or otherwise. – speedRS Feb 26 '14 at 5:40

Yes, there's a PAM module for just about everything. You pick your auth token, there's a PAM module for it. SecurID, Yubikey, Text Message, you name it. And yes, also TOTP (e.g. Google Authenticator, Microsoft Authenticator, etc)

If you're looking for doing authentication somewhere other than PAM, then perhaps you should re-evaluate your goals. They call it Pluggable Authentication Modules for a reason. That's exactly where authentication should happen.

|improve this answer|||||
  • Out of curiosity for the TOTP options you mention, are they reliant on connectivity with Google, for instance. For instance, if I wanted to have TOTP just on my internal network with no WAN connectivity, is that doable or are Google/MS involved at some point during the initial setup process (ie. generating the 2D barcode, etc)? – speedRS Feb 26 '14 at 5:52
  • 1
    @speedRS No. Go read the spec. – tylerl Feb 26 '14 at 5:57
  • The google-authenticator PAM module works fine with OpenSSH, it's self-contained (no Google servers involved). If you're using it with a TOTP token though, note it has a hard-coded timestep of 30s which may need to be modified (some use 60s). – mr.spuratic Feb 26 '14 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.