User Tools
2fa
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| 2fa [2024/05/03 18:21] – changed to "it means that only 2FA authentication is operating" hogwild | 2fa [2024/10/28 15:11] (current) – -Correct instructions for: "/opt/etc/ssh/sshd_config" changes hogwild | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Setting up 2FA for SSH using Google Authenticator ====== | ====== Setting up 2FA for SSH using Google Authenticator ====== | ||
| - | This content was taken from the following | + | This content was taken from a Tomato |
| + | |||
| + | These are simple configuration notes, and not intended to be a complete HOWTO. This setup uses openssh with google-authenticator as 2-Factor Authentication. Only the " | ||
| + | |||
| + | Install openssh-server and google-authenticator: | ||
| \\ | \\ | ||
| - | These are simple configuration notes and thus not intended to be a complete HOWTO. | + | opkg install |
| - | + | ||
| - | This setup uses openssh | + | |
| \\ | \\ | ||
| - | Prerequisite: | + | If this completes without all dependencies, |
| - | | + | |
| - | opkg install | + | Next, enable |
| - | Hopefully, this will include all dependencies. | + | \\ \\ Configure the correct settings in configuration file / |
| \\ | \\ | ||
| - | |||
| - | Next, enable openssh-server . This is not covered here. < | ||
| - | |||
| - | Next, configure the correct settings in configuration file / | ||
| #!/bin/sh | #!/bin/sh | ||
| Line 52: | Line 50: | ||
| \\ | \\ | ||
| - | The new service must be enabled at boot time as well: | + | The new service must be enabled at boot time as well. Make the following changes to the file: "/ |
| - | / | + | \\ |
| Port 2222 # to be changed if desired | Port 2222 # to be changed if desired | ||
| Line 65: | Line 63: | ||
| HostKey / | HostKey / | ||
| HostKey / | HostKey / | ||
| + | |||
| + | \\ | ||
| grep -v "#" | grep -v "#" | ||
| + | |||
| + | \\ | ||
| auth required pam_env.so | auth required pam_env.so | ||
| Line 87: | Line 89: | ||
| password include common-password | password include common-password | ||
| + | |||
| + | \\ | ||
| \\ | \\ | ||
| Now, run google-auth setup and follow the steps: | Now, run google-auth setup and follow the steps: | ||
| + | |||
| + | \\ | ||
| google-authenticator | google-authenticator | ||
| + | |||
| + | \\ | ||
| Remember to register the TOTP code, or load into an app such as AndOTP. | Remember to register the TOTP code, or load into an app such as AndOTP. | ||
| Line 98: | Line 106: | ||
| \\ | \\ | ||
| - | Next, move its config file (.google_authenciator) to the /opt/etc directory: | + | \\ |
| + | |||
| + | Next, move its config file (.google_authenticator) to the /opt/etc directory: | ||
| + | |||
| + | \\ | ||
| mv .google_authenticator /opt/etc/ | mv .google_authenticator /opt/etc/ | ||
| Line 104: | Line 116: | ||
| \\ | \\ | ||
| - | Next, Verify the permissions on the file are 0600 . This is very important. | + | Next, Verify the permissions on the file are "0600" |
| + | |||
| + | \\ | ||
| chmod 0600 / | chmod 0600 / | ||
| Line 111: | Line 125: | ||
| Now, you should be able to start the sshd service: | Now, you should be able to start the sshd service: | ||
| + | |||
| + | \\ | ||
| / | / | ||
| Line 116: | Line 132: | ||
| \\ | \\ | ||
| - | Next, test it from the LAN side: | + | |
| - | ssh -p 2222 root@< | + | \\ |
| - | You should see the following | + | ssh -p 2222 root@< |
| + | |||
| + | \\ | ||
| + | |||
| + | You should see the following: | ||
| + | |||
| + | \\ | ||
| The authenticity of host ' | The authenticity of host ' | ||
| Line 129: | Line 151: | ||
| \\ | \\ | ||
| - | Now, you should see the following: | + | After typing Yes, you should see the following: |
| + | |||
| + | \\ | ||
| Keyboard-interactive authentication prompts from server: | Keyboard-interactive authentication prompts from server: | ||
| | Verification code: | | Verification code: | ||
| - | If you see this, it means that only 2FA authentication | + | |
| - | + | ||
| - | \\ | + | |
| - | + | ||
| - | You can now expose port 2222 (or the port you configured) to the Internet | + | |
| \\ | \\ | ||
2fa.1714756880.txt.gz · Last modified: 2024/05/03 18:21 by hogwild
Page Tools
