私はDebian 12を使用しており、pubkeyとTOTPを使用してSSH 2fa用のpam_google_authenticator.soを設定しようとしています。
google-authenticatorを使用して設定を完了し、2FAコードにトークンを入力したところ、うまくいきました。ところで、パスワードの入力に失敗しました。
設定：
$ google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/itadmin@server01%3Fsecret%xxxxxxxxxxxxxxxxxxxxxxxxxxx%26issuer%3Dserver01
Your new secret key is: xxxxxxxxxxxxxxxxxxxxxxxxxxx
Enter code from app (-1 to skip): xxxxxx
Code confirmed
Your emergency scratch codes are:
xxxxxxxx
xxxxxxxx
xxxxxxxx
xxxxxxxx
xxxxxxxx
Do you want me to update your "/home/itadmin/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) n
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
$ ls -lisa
total 28
783373 4 drwxr-xr-x 3 itadmin itadmin 4096 Aug 9 19:15 .
783364 4 drwxr-xr-x 4 root root 4096 Aug 9 18:40 ..
783392 4 -rw-r--r-- 1 itadmin itadmin 220 Aug 4 2021 .bash_logout
783393 4 -rw-r--r-- 1 itadmin itadmin 1811 Aug 9 18:43 .bashrc
783396 4 -r-------- 1 itadmin itadmin 119 Aug 9 19:15 .google_authenticator
783391 4 -rw-r--r-- 1 itadmin itadmin 807 Aug 4 2021 .profile
783394 4 drwxr-xr-x 2 itadmin itadmin 4096 Aug 9 18:40 .ssh
その後、sshd_configとpam sshdを修正しました。
/etc/pam.d/sshd
# PAM configuration for the Secure Shell service
# Standard Un*x authentication.
@include common-auth
# Disallow non-root logins when /etc/nologin exists.
account required pam_nologin.so
# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so
# Standard Un*x authorization.
@include common-account
# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
# Set the loginuid process attribute.
session required pam_loginuid.so
# Create a new session keyring.
session optional pam_keyinit.so force revoke
# Standard Un*x session setup and teardown.
@include common-session
# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate
# Print the status of the user's mailbox upon successful login.
session optional pam_mail.so standard noenv # [1]
# Set up user limits from /etc/security/limits.conf.
session required pam_limits.so
# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context. Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
# 2FA TOTP Authentication
auth required pam_google_authenticator.so
/etc/ssh/sshd_config
#General Options
Port 22
AddressFamily inet
ListenAddress 0.0.0.0
Protocol 2
#
#Crypto Options
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
#
#Authentication:
PermitRootLogin no
LoginGraceTime 2m
StrictModes yes
MaxAuthTries 3
MaxSessions 6
rekeylimit 500M 1h
#
#Other Auth Options
UsePAM yes
GSSAPIAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
PermitEmptyPasswords no
#
#Key Authentication
AuthorizedKeysFile .ssh/authorized_keys
PubkeyAuthentication yes
PasswordAuthentication no
#
#MISC OPTIONS
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
GatewayPorts no
X11Forwarding no
PermitTTY yes
TCPKeepAlive no
PermitUserEnvironment no
Compression yes
ClientAliveInterval 300
ClientAliveCountMax 3
UseDNS no
PidFile /var/run/sshd.pid
MaxStartups 10:50:40
PrintLastLog no
PrintMotd no
VersionAddendum none
Banner none
DebianBanner no
#
#Chroot Options
#ChrootDirectory none
#
#Match Blocks
Match Address 192.168.0.2
AllowUsers itadmin
ただし、SSH経由で現在の2FAコードを入力すると、「パスワード」は失敗します。
$ ssh server01
([email protected]) Password:
([email protected]) Password:
([email protected]) Password:
Received disconnect from 192.168.0.24 port 22:2: Too many authentication failures
Disconnected from 192.168.0.24 port 22
$
参照用のSSHクライアントの設定：
Host server01
Hostname 192.168.0.24
User itadmin
IdentityFile ~/.ssh/servers.priv
IdentitiesOnly yes
最初はモジュールテストに成功しましたが、今はログインに失敗する2faコードがありますか？
AuthenticationMethods publickey,keyboard-interactive他のすべてはうまくいきます。その行をコメントアウトしてsshd_configサービスを再起動すると、クライアントから正常にログインできます。
ユーザーがログインすると、pamの認証モジュールはユーザーのホームディレクトリにあるファイルを読み込みますか？それともこれは単なるコピーであり、設定は実際に別の場所に保存されますか？
ここで何の問題がありますか？ ？