Skip to content

Instantly share code, notes, and snippets.

@jeffgeiger

jeffgeiger/SSH_2FA_Google.md

Last active March 13, 2018 03:40
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save jeffgeiger/6239a6074de3a419437ecb5df23c6f72 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save jeffgeiger/6239a6074de3a419437ecb5df23c6f72 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. jeffgeiger revised this gist Feb 3, 2017. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions SSH_2FA_Google.md
    View file
    Original file line number Diff line number Diff line change
    @@ -4,6 +4,7 @@
    # Also note, the repo has moved, so you need to adjust the git path:
    # https://github.com/google/google-authenticator-libpam
    sudo yum install epel-release -y
    sudo yum install qrencode qrencode-devel qrencode-libs
    sudo yum install google-authenticator-1.03-1.el7.centos.x86_64.rpm
    google-authenticator #per-user setup
  2. jeffgeiger created this gist Feb 3, 2017.
    26 changes: 26 additions & 0 deletions SSH_2FA_Google.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,26 @@
    ```
    ## Build RPM as per https://github.com/google/google-authenticator-libpam/blob/master/contrib/README.rpm.md
    # Do this elsewhere, you don't want dev tools on a box you're trying to secure. ;)
    # Also note, the repo has moved, so you need to adjust the git path:
    # https://github.com/google/google-authenticator-libpam
    sudo yum install qrencode qrencode-devel qrencode-libs
    sudo yum install google-authenticator-1.03-1.el7.centos.x86_64.rpm
    google-authenticator #per-user setup
    sudo vim /etc/pam.d/sshd
    # Add (top item)
    # ---
    auth sufficient pam_google_authenticator.so
    # ---
    sudo vim /etc/ssh/sshd_config
    # Modify /etc/ssh/sshd_config (Add/change the following)
    # ---
    ChallengeResponseAuthentication yes
    UsePAM yes
    AuthenticationMethods publickey,keyboard-interactive
    PasswordAuthentication no
    # ---
    systemctl restart sshd
    ```