Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)
Are there any libraries/apps present in Ubuntu that support multi-factor authentication? What would be good resources to find more about this?
Duo Security's open source duo_unix project demonstrates how to do this with PAM and sshd (and Duo's two-factor service). Disclaimer, I am a Duo engineer.
I believe the current authentication stuff is all done within Linux-PAM. The Man page has some details about how it works. What you would need to do is find two authentication modules to plug in and then configure PAM to chain them. Having said that, I'm not sure if it's possible, but it's a good starting point.
Best of luck
Most one-time password systems support radius, so pam-radius is the way to go. see kernel.org/pub/linux/libs/pam/ for a lot of stuff.
HTH,
Nick
also you want to edit /etc/pam.d/login for this. there is a usb/key based solution for this, but I can't remember what it is. Be careful - as changing login could mean - no login. ;). Keep an SSH connection open so you can back out changes. Keep a copy of the original. Also - keep in mind that you will want to lock down SSH too.
