17

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)

Are there any libraries/apps present in Ubuntu that support multi-factor authentication? What would be good resources to find more about this?

8

Duo Security's open source duo_unix project demonstrates how to do this with PAM and sshd (and Duo's two-factor service). Disclaimer, I am a Duo engineer.

7

I believe the current authentication stuff is all done within Linux-PAM. The Man page has some details about how it works. What you would need to do is find two authentication modules to plug in and then configure PAM to chain them. Having said that, I'm not sure if it's possible, but it's a good starting point.

Best of luck

7

Most one-time password systems support radius, so pam-radius is the way to go. see kernel.org/pub/linux/libs/pam/ for a lot of stuff.

HTH,

Nick

also you want to edit /etc/pam.d/login for this. there is a usb/key based solution for this, but I can't remember what it is. Be careful - as changing login could mean - no login. ;). Keep an SSH connection open so you can back out changes. Keep a copy of the original. Also - keep in mind that you will want to lock down SSH too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.