Google 2-factor authentication
By Jon Jensen
March 14, 2011
About a month ago, Google made available to all users their new 2-factor authentication, which they call 2-step authentication. In addition to the customary username and password, this optional new feature requires that you enter a 6-digit number that changes every 30 seconds, generated by the Google Authenticator app on your Android, BlackBerry, or iPhone. The app looks like this:
This was straightforward to set up and has worked well for me in the past month. It would thwart bad guys who intercept your password in most cases. It would also lock you out of your Google account if you lose your phone and your emergency scratch codes. :)
I was happy to see this is all based on some open standards under development, and Google has made this even more useful by releasing an open source PAM module called google-authenticator. With that PAM module, a Linux system administrator can require a Google Authenticator code in addition to password authentication for login.
I tried this out on a CentOS x86_64 system and found it fairly straightforward to set up. I ran into two minor gotchas which were reported by others as well:
-
The Makefile calls sudo directly, which it shouldn’t—I was running a minimal installation without sudo installed, and in any case the administrator should decide when to become root and how. (Issue 17)
-
The Makefile installs into /lib/security instead of /lib64/security. This has since been fixed. (Issue 6)
After build and installation it was easy to generate a secret key for each individual user account. The key is stored in the user’s home directory, which Issue 4 notes has some downsides, and the resolution to Issue 24 provides a partial workaround for this. The home directory seems like a nice default to me.
In the end, I found the google-authenticator module isn’t suitable for my regular ssh use due to no fault of its developers. I normally use SSH public key authentication and that’s handled by OpenSSH natively, separately from PAM, and thus bypasses 2-factor authentication entirely. So I can have 2-factor authentication with password authentication, but not with public key authentication, which is really what I want.
Does anyone know of a way to configure things that way? I wasn’t able to find a way, so I’m not planning on using this for shell logins right now. But it’s still a nice option for Google logins right now, and I expect the google-authenticator project will advance over time.
hosting linux mobile open-source redhat security sysadmin
Comments