The "Secure Shell" (SSH) is a network protocol for establishing a secure connection between hosts, typically over port 22 (which is better changed). SSH clients and SSH servers are available for most operating systems. Inside SSH, virtually any other network protocol can operate, which means you can work remotely on another computer, transfer audio or video streams over an encrypted channel, etc. Additionally, through a SOCKS proxy on the remote host you can connect to other hosts from the perspective of this remote host.

Authentication occurs via password, but developers and system administrators traditionally use SSH keys. The problem is that the private key can be stolen. Adding a passphrase theoretically protects against the theft of the private key, but in practice, when forwarding and caching keys, they can still be used without confirmation. Two-factor authentication addresses this issue.

How to Implement Two-Factor Authentication

Recently, developers from Honeycomb published a detailed guideon how to implement the appropriate infrastructure on both the client and server.

The guide assumes that you have a basic host open to the internet (a bastion). You want to connect to this host from laptops or computers over the internet and access all other devices located behind it. 2FA ensures that an attacker cannot do the same, even if they gain access to your laptop, for example, by installing malware.

The first option is OTP

OTP are one-time digital passwords that, in this case, will be used for SSH authentication along with the key. The developers write that this is not an ideal option, because an attacker may set up a fake bastion, intercept your OTP, and use it. But it's better than nothing.

In this case, the following lines are typed in the Chef config on the server side:

• metadata.rb
• attributes/default.rb (from attributes.rb)
• files/sshd
• recipes/default.rb (copy from recipe.rb)
• templates/default/users.oath.erb

On the client side, any OTP application can be installed: Google Authenticator, Authy, Duo, Lastpass, and run brew install oath-toolkit or apt install oathtool openssl, then a random base16 string (key) is generated. It is converted to Base32 format, which is used by mobile authenticators, and imported directly into the application.

As a result, you can connect to the bastion and confirm that it now requires not only a passphrase but also an OTP code for authentication:

➜ ssh -A bastion
Enter passphrase for key '[snip]': 
One-time password (OATH) for '[user]': 
Welcome to Ubuntu 18.04.1 LTS...

The second option is hardware authentication.

In this case, the user is not required to enter the OTP code each time, as a hardware device or biometrics becomes the second factor.

Here, the Chef configuration is a bit more complex, and the client configuration depends on the OS. However, after completing all the steps, clients on MacOS can confirm authentication in SSH using a passphrase and a fingerprint on the sensor (the second factor).

iOS and Android users confirm their login by pressing a button on their smartphone.This is a special technology from Krypt.co, which is even more secure than OTP.

On Linux/ChromeOS, there is an option to work with YubiKey USB tokens. Of course, an attacker can steal your token, but they still do not know the passphrase.

Source: habr.com