| 1 |
On Tue, Jun 23, 2015 at 8:49 AM, Helmut Jarausch <jarausch@××××××.be> wrote: |
| 2 |
> Hi, |
| 3 |
> |
| 4 |
> I'd like to log into my Gentoo system from my smartphone. |
| 5 |
> But I don't trust Google (Android's parents). |
| 6 |
> Therefore I need a OTP solution for loggin into my Gentoo system. |
| 7 |
> |
| 8 |
> Can anybody recommend a solution? |
| 9 |
> |
| 10 |
|
| 11 |
You'll laugh at the irony, but my /etc/pam.d/sshd: |
| 12 |
auth include system-remote-login |
| 13 |
auth required pam_google_authenticator.so |
| 14 |
account include system-remote-login |
| 15 |
password include system-remote-login |
| 16 |
session include system-remote-login |
| 17 |
|
| 18 |
The Google Authenticator PAM module comes from |
| 19 |
sys-auth/google-authenticator, and accepts OTPs from the Google |
| 20 |
Authenticator app, or any other app that uses the same algorithm |
| 21 |
(which is fairly standard I believe). It is FOSS, and doesn't give |
| 22 |
Google access to anything. |
| 23 |
|
| 24 |
That one line is all it takes to block anybody not using an OTP from |
| 25 |
logging in. To actually set the key for an account there is a utility |
| 26 |
that will generate a key and give you the seed for your OTP generator. |
| 27 |
It stores a file in your home directory with the seed, which the PAM |
| 28 |
module reads. |
| 29 |
|
| 30 |
It is very simple to set up, and very effective. Note that public key |
| 31 |
authentication with sshd normally bypasses PAM and doesn't require the |
| 32 |
code - I don't know offhand if you can have both. |
| 33 |
|
| 34 |
-- |
| 35 |
Rich |
Archives