blackMORE
2014-06-26, 14:58
Those who knows and are interested, I've posted a step by step guide on how to secure SSH using two factor authentication using Google Authenticator. To me this seems a good guide and a better way to secure SSH. Debates/suggestions welcome.
I tried to paste the guide here but apparently Kali forums got character limitations and I got the following error message when I tried to paste it here.
(The text that you have entered is too long (16159 characters). Please shorten it to 10000 characters long)
I tried dividing the post into multiple parts but then I got another error where I can only use 4 images per message.
You have included a total of 6 images in your message. The maximum number that you may include is 4. Please correct the problem and then continue again.
Images include use of smilies, the BB code [img] tag, and HTML <img> tags. The use of these is all subject to them being enabled by the administrator.
So I am Leaving a link here so that interested users can find and read it.
Link to original post: http://www.blackmoreops.com/2014/06/26/securing-ssh-two-factor-authentication-using-google-authenticator/
Securing SSH with two factor authentication using Google Authenticator
(http://www.blackmoreops.com/2014/06/26/securing-ssh-two-factor-authentication-using-google-authenticator/)
Two-step verification (also known as Two-factor authentication, abbreviated to TFA) is a process involving two stages to verify the identity of an entity trying to access services in a computer or in a network. This is a special case of a multi-factor authentication which might involve only one of the three authentication factors (a knowledge factor, a possession factor, and an inheritance factor) for both steps. If each step involves a different authentication factor then the two-step verification is additionally two-factor authentication.
Google’s two-step verification process
Google was one of the first Internet companies to introduce a two-step verification process. To access a Google service using the two-step verification process, a user has to go through the following two stages:
The first step is to log in using the username and password. This is an application of the knowledge factor.
The implementation of the second step requires a mobile phone or the Google Authenticator application, which is an application of the possession factor.
If the user opts to use a mobile phone, he/she has to register his/her phone number with Google. When one attempts to authenticate with username and password, Google will send via SMS a new, unique code to the phone. Receiving the SMS demonstrates that the user has the phone (or, in the case of GSM like networks the appropriate SIM chip).
If the user opts to use the Google Authenticator (or another supported code generator application), he/she simply opens the application, which generates a new code every 30 seconds. This code is to be entered to complete the log in process. As a backup option in case the registered mobile phone or device running Google Authenticator is lost, stolen, or otherwise unavailable, the user can print a set of static single-use backup codes (also the knowledge factor) and store them in a safe place.
The following are some other sites which offer two-step verification service:
Amazon Web Services
ANX
App.net
Apple ID
Authy
Battle.net
Bitstamp
Blockchain.info
Box
Dropbox
eBay
Etrade
Evernote
Facebook
GitHub
GoDaddy
HootSuite
Lastpass
LinkedIn
LocalBitcoins
Microsoft
MongoLab
Namecheap
PayPal
SocialFlow
timetotrade
Tumblr
Twitter
Viaduct
WordPress
Yahoo! Mail
innoview.gr
zoho
Google Authenticator
Google Authenticator implements TOTP security tokens from RFC6238 in mobile apps made by Google, sometimes branded “two-step authentication”. The Authenticator provides a six digit one-time password users must provide in addition to their username and password to log into Google services or other sites. The Authenticator can also generate codes for third party applications, such as password managers or file hosting services. Some versions of the software are open source.
[Source: WikiPedia]
http://www.blackmoreops.com/wp-content/uploads/2014/06/14-Securing-SSH-with-two-factor-authentication-using-Google-Authenticator-blackMORE-Ops.png (http://www.blackmoreops.com/wp-content/uploads/2014/06/14-Securing-SSH-with-two-factor-authentication-using-Google-Authenticator-blackMORE-Ops.png)
Note: Google Authenticator doesn’t “call home” to Google — all the work happens on your SSH server and your phone. Google Authenticator is a open-source software, that means you can check the codes yourself. I guess after what happened with openSSL, that’s not a bad idea after all.
In this article I will demonstrate how to secure SSH by setting up Two Factor Authentication (TFA) with Google Authenticator for the following Linux operating systems:
Debian
Ubuntu
Linux Mint
Kali Linux
Red Hat
CentOS
Fedora
Google Authenticator can be used in the following smartphones:
Android,
iOS and
Blackberry.
I am not too sure if you can use this on a Windows Based phone (i.e. new Nokia phones or Windows Mobiles devices). Feel free to try and report back.
App Download Links as follows:
Android: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en
iOS: https://itunes.apple.com/au/app/google-authenticator/id388497605?mt=8
Blackberry: http://www.google.com/mobile/other
More detailed per device install instructions can be found on this page:
https://support.google.com/accounts/answer/1066447?hl=en
The implementation is exactly same except for some package name differences. So you can implement this in any Linux Operating System that uses these packages.
Requirements
Followings are the requirements for using Google Authenticator on your system:
A PC running Linux
A smartphone
A running SSH server on your machine.
In case you don’t have SSH server running, just follow this guide to install openSSH server. (http://www.blackmoreops.com/2014/06/19/kali-linux-remote-ssh/)
Link to original post: http://www.blackmoreops.com/2014/06/26/securing-ssh-two-factor-authentication-using-google-authenticator/
p.s. @MOD: if this violates any policy, feel free to remove this post. Thanks.
I tried to paste the guide here but apparently Kali forums got character limitations and I got the following error message when I tried to paste it here.
(The text that you have entered is too long (16159 characters). Please shorten it to 10000 characters long)
I tried dividing the post into multiple parts but then I got another error where I can only use 4 images per message.
You have included a total of 6 images in your message. The maximum number that you may include is 4. Please correct the problem and then continue again.
Images include use of smilies, the BB code [img] tag, and HTML <img> tags. The use of these is all subject to them being enabled by the administrator.
So I am Leaving a link here so that interested users can find and read it.
Link to original post: http://www.blackmoreops.com/2014/06/26/securing-ssh-two-factor-authentication-using-google-authenticator/
Securing SSH with two factor authentication using Google Authenticator
(http://www.blackmoreops.com/2014/06/26/securing-ssh-two-factor-authentication-using-google-authenticator/)
Two-step verification (also known as Two-factor authentication, abbreviated to TFA) is a process involving two stages to verify the identity of an entity trying to access services in a computer or in a network. This is a special case of a multi-factor authentication which might involve only one of the three authentication factors (a knowledge factor, a possession factor, and an inheritance factor) for both steps. If each step involves a different authentication factor then the two-step verification is additionally two-factor authentication.
Google’s two-step verification process
Google was one of the first Internet companies to introduce a two-step verification process. To access a Google service using the two-step verification process, a user has to go through the following two stages:
The first step is to log in using the username and password. This is an application of the knowledge factor.
The implementation of the second step requires a mobile phone or the Google Authenticator application, which is an application of the possession factor.
If the user opts to use a mobile phone, he/she has to register his/her phone number with Google. When one attempts to authenticate with username and password, Google will send via SMS a new, unique code to the phone. Receiving the SMS demonstrates that the user has the phone (or, in the case of GSM like networks the appropriate SIM chip).
If the user opts to use the Google Authenticator (or another supported code generator application), he/she simply opens the application, which generates a new code every 30 seconds. This code is to be entered to complete the log in process. As a backup option in case the registered mobile phone or device running Google Authenticator is lost, stolen, or otherwise unavailable, the user can print a set of static single-use backup codes (also the knowledge factor) and store them in a safe place.
The following are some other sites which offer two-step verification service:
Amazon Web Services
ANX
App.net
Apple ID
Authy
Battle.net
Bitstamp
Blockchain.info
Box
Dropbox
eBay
Etrade
Evernote
GitHub
GoDaddy
HootSuite
Lastpass
LocalBitcoins
Microsoft
MongoLab
Namecheap
PayPal
SocialFlow
timetotrade
Tumblr
Viaduct
WordPress
Yahoo! Mail
innoview.gr
zoho
Google Authenticator
Google Authenticator implements TOTP security tokens from RFC6238 in mobile apps made by Google, sometimes branded “two-step authentication”. The Authenticator provides a six digit one-time password users must provide in addition to their username and password to log into Google services or other sites. The Authenticator can also generate codes for third party applications, such as password managers or file hosting services. Some versions of the software are open source.
[Source: WikiPedia]
http://www.blackmoreops.com/wp-content/uploads/2014/06/14-Securing-SSH-with-two-factor-authentication-using-Google-Authenticator-blackMORE-Ops.png (http://www.blackmoreops.com/wp-content/uploads/2014/06/14-Securing-SSH-with-two-factor-authentication-using-Google-Authenticator-blackMORE-Ops.png)
Note: Google Authenticator doesn’t “call home” to Google — all the work happens on your SSH server and your phone. Google Authenticator is a open-source software, that means you can check the codes yourself. I guess after what happened with openSSL, that’s not a bad idea after all.
In this article I will demonstrate how to secure SSH by setting up Two Factor Authentication (TFA) with Google Authenticator for the following Linux operating systems:
Debian
Ubuntu
Linux Mint
Kali Linux
Red Hat
CentOS
Fedora
Google Authenticator can be used in the following smartphones:
Android,
iOS and
Blackberry.
I am not too sure if you can use this on a Windows Based phone (i.e. new Nokia phones or Windows Mobiles devices). Feel free to try and report back.
App Download Links as follows:
Android: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en
iOS: https://itunes.apple.com/au/app/google-authenticator/id388497605?mt=8
Blackberry: http://www.google.com/mobile/other
More detailed per device install instructions can be found on this page:
https://support.google.com/accounts/answer/1066447?hl=en
The implementation is exactly same except for some package name differences. So you can implement this in any Linux Operating System that uses these packages.
Requirements
Followings are the requirements for using Google Authenticator on your system:
A PC running Linux
A smartphone
A running SSH server on your machine.
In case you don’t have SSH server running, just follow this guide to install openSSH server. (http://www.blackmoreops.com/2014/06/19/kali-linux-remote-ssh/)
Link to original post: http://www.blackmoreops.com/2014/06/26/securing-ssh-two-factor-authentication-using-google-authenticator/
p.s. @MOD: if this violates any policy, feel free to remove this post. Thanks.