저는 Debian 12를 사용하고 있으며 pubkey 및 TOTP를 사용하여 SSH 2fa용 pam_google_authenticator.so를 설정하려고 합니다.
google-authenticator를 사용하여 설정을 완료하고 2FA 코드에 토큰을 입력했더니 제대로 작동했습니다. 그런데 비밀번호 입력에 실패했습니다.
설정:
$ google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/itadmin@server01%3Fsecret%xxxxxxxxxxxxxxxxxxxxxxxxxxx%26issuer%3Dserver01
Your new secret key is: xxxxxxxxxxxxxxxxxxxxxxxxxxx
Enter code from app (-1 to skip): xxxxxx
Code confirmed
Your emergency scratch codes are:
xxxxxxxx
xxxxxxxx
xxxxxxxx
xxxxxxxx
xxxxxxxx
Do you want me to update your "/home/itadmin/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) n
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
$ ls -lisa
total 28
783373 4 drwxr-xr-x 3 itadmin itadmin 4096 Aug 9 19:15 .
783364 4 drwxr-xr-x 4 root root 4096 Aug 9 18:40 ..
783392 4 -rw-r--r-- 1 itadmin itadmin 220 Aug 4 2021 .bash_logout
783393 4 -rw-r--r-- 1 itadmin itadmin 1811 Aug 9 18:43 .bashrc
783396 4 -r-------- 1 itadmin itadmin 119 Aug 9 19:15 .google_authenticator
783391 4 -rw-r--r-- 1 itadmin itadmin 807 Aug 4 2021 .profile
783394 4 drwxr-xr-x 2 itadmin itadmin 4096 Aug 9 18:40 .ssh
그런 다음 sshd_config 및 pam sshd를 수정했습니다.
/etc/pam.d/sshd
# PAM configuration for the Secure Shell service
# Standard Un*x authentication.
@include common-auth
# Disallow non-root logins when /etc/nologin exists.
account required pam_nologin.so
# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so
# Standard Un*x authorization.
@include common-account
# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
# Set the loginuid process attribute.
session required pam_loginuid.so
# Create a new session keyring.
session optional pam_keyinit.so force revoke
# Standard Un*x session setup and teardown.
@include common-session
# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate
# Print the status of the user's mailbox upon successful login.
session optional pam_mail.so standard noenv # [1]
# Set up user limits from /etc/security/limits.conf.
session required pam_limits.so
# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context. Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
# 2FA TOTP Authentication
auth required pam_google_authenticator.so
/etc/ssh/sshd_config
#General Options
Port 22
AddressFamily inet
ListenAddress 0.0.0.0
Protocol 2
#
#Crypto Options
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
#
#Authentication:
PermitRootLogin no
LoginGraceTime 2m
StrictModes yes
MaxAuthTries 3
MaxSessions 6
rekeylimit 500M 1h
#
#Other Auth Options
UsePAM yes
GSSAPIAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
PermitEmptyPasswords no
#
#Key Authentication
AuthorizedKeysFile .ssh/authorized_keys
PubkeyAuthentication yes
PasswordAuthentication no
#
#MISC OPTIONS
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
GatewayPorts no
X11Forwarding no
PermitTTY yes
TCPKeepAlive no
PermitUserEnvironment no
Compression yes
ClientAliveInterval 300
ClientAliveCountMax 3
UseDNS no
PidFile /var/run/sshd.pid
MaxStartups 10:50:40
PrintLastLog no
PrintMotd no
VersionAddendum none
Banner none
DebianBanner no
#
#Chroot Options
#ChrootDirectory none
#
#Match Blocks
Match Address 192.168.0.2
AllowUsers itadmin
그러나 SSH를 통해 현재 2FA 코드를 입력하면 "비밀번호"가 실패합니다.
$ ssh server01
([email protected]) Password:
([email protected]) Password:
([email protected]) Password:
Received disconnect from 192.168.0.24 port 22:2: Too many authentication failures
Disconnected from 192.168.0.24 port 22
$
참조용 SSH 클라이언트 구성:
Host server01
Hostname 192.168.0.24
User itadmin
IdentityFile ~/.ssh/servers.priv
IdentitiesOnly yes
처음에는 모듈 테스트에 성공했지만 지금은 로그인에 실패하는 2fa 코드가 있습니까?
AuthenticationMethods publickey,keyboard-interactive다른 모든 것은 잘 작동합니다. 해당 줄을 주석 처리 sshd_config하고 서비스를 다시 시작하면 클라이언트에서 정상적으로 로그인할 수 있습니다.
사용자가 로그인하면 pam의 인증 모듈이 사용자의 홈 디렉터리에 있는 파일을 읽습니까? 아니면 이것은 단지 복사본이고 설정은 실제로 다른 곳에 저장됩니까?
여기서 무슨 문제가 있습니까? ?