Google Authenticator for PAM
Google Authenticator is pretty cool, it's like having one of those RSA SecurID tokens for two-factor auth.
I stumbled across this page which describes integrating it with PAM for SSH, the backend code is freely available. http://guides.webbynode.com/articles/security/ubuntu-google-authenticator.html
It's not packaged or anything, but it's trivial to compile and put in the right place on a standard linux system. Their guide is very good, and inexperienced sysadmins can probably stumble through it without any specific knowledge.
There's a couple of tiny things I'd change. Also worthy of note is that I haven't got it to work properly yet. >_>
But I can tell it's really close!
When I first tried, it kept insisting that I wasn't providing a verification code (/var/log/auth.log)
- I messed around some more, kept recompiling, and eventually stopped even getting error messages -_-
- Gave up at this point, need to revisit
Things I'd do differently.
- Install it manually (I'm on Debian Squeeze x64)
make all instead of make install
Use install instead of tar and... wtf is this!?
install -m 755 -g root google-authenticator /usr/local/bin/google-authenticator install -m 644 pam_google_authenticator_testing.so /lib/security/pam_google_authenticator.so
- Integration with PAM
Put it in /etc/pam.d/sshd instead of /etc/pam.d/common-auth (can FTP deal with this? will it just skip the challenge-response thing? I dunno)
You could, if you want, use this instead of a password (instead of in addition to a password). You do this by making the module sufficient instead of a requirement along with the password (pam_unix)
auth sufficient pam_google_authenticator.so echo-verification-code
The per-user config thing works just fine.