Skip to content
This repository was archived by the owner on May 9, 2018. It is now read-only.

Add a customizable grace period to prevent TFA prompts after a recent successful login attempt #32

Open
wants to merge 19 commits into
base: master
Choose a base branch
from
Open

Add a customizable grace period to prevent TFA prompts after a recent successful login attempt #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
5301a3c
Add support for a grace time period, so that two-factor authenticatio…
DigitalDJ Jun 13, 2014
37d3a13
Update README for grace-time argument
DigitalDJ Jun 13, 2014
65fa25b
Update test cases to test invalid grace-time values for enable and pr…
DigitalDJ Jun 13, 2014
59e7a30
Bump version to 1.5
DigitalDJ Jun 13, 2014
bbfb41d
The last login file should only be readwrite by that user
DigitalDJ Jun 14, 2014
df143ba
Fix shell closing after requesting an SMS token
DigitalDJ Jun 14, 2014
7538426
Add some extra folder security to the folder containing the last-logi…
DigitalDJ Jun 16, 2014
b6f1036
Move error message about missing sshd file to some place more relevan…
DigitalDJ Jun 16, 2014
0ee677b
Add a load_default_banner option to config that will show the default…
DigitalDJ Jun 16, 2014
356ca52
SMS shell closure fix pt.2 Sometimes the response via API says "SMS w…
DigitalDJ Jun 16, 2014
8589efd
Add documentation for load_default_banner
DigitalDJ Jun 16, 2014
64145e6
Update install unit test for load_default_banner
DigitalDJ Jun 16, 2014
aa899c0
Version bump 1.6
DigitalDJ Jun 16, 2014
a781362
Fix URL in curl command to github's redirected URL
DigitalDJ Jul 4, 2014
9b29aa9
Finally fix problem with disconnecting after invalid token or sms req…
DigitalDJ Jul 4, 2014
28ecd12
Save load_default_banner to config file
DigitalDJ Oct 4, 2014
6e5ff18
Merge remote-tracking branch 'upstream/master'
DigitalDJ Mar 1, 2015
d651e06
Merge remote-tracking branch 'upstream/master'
Dec 6, 2015
fd29e3f
Merge remote-tracking branch 'upstream/master'
Feb 10, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@

Type the following command in the terminal:

$ curl -O 'https://raw.githubusercontent.com/authy/authy-ssh/master/authy-ssh'
$ curl -O 'https://raw.githubusercontent.com/DigitalDJ/authy-ssh/master/authy-ssh'
$ sudo bash authy-ssh install /usr/local/bin

Then enable two-factor for your user:

$ sudo /usr/local/bin/authy-ssh enable `whoami` <your-email> <your-country-code> <your-cellphone>
$ sudo /usr/local/bin/authy-ssh enable `whoami` <your-email> <your-country-code> <your-cellphone> [grace-period]

Test everything is working:

Expand Down Expand Up @@ -45,7 +45,7 @@ Restart your SSH server (look below if you are not on Ubuntu).

Type the following command in the terminal:

$ curl 'https://raw.githubusercontent.com/authy/authy-ssh/master/authy-ssh' -o authy-ssh
$ curl 'https://raw.githubusercontent.com/DigitalDJ/authy-ssh/master/authy-ssh' -o authy-ssh
$ bash authy-ssh install ~/.authy-ssh/


Expand All @@ -64,7 +64,7 @@ To enable users type the following command and fill the form:

If you want to do it in one line just type:

$ sudo authy-ssh enable <local-username> <user-email> <user-cellphone-country-code> <user-cellphone>
$ sudo authy-ssh enable <local-username> <user-email> <user-cellphone-country-code> <user-cellphone> [grace-period]


## How it works
Expand All @@ -79,11 +79,17 @@ Here's an example:

[root@ip-10-2-113-233 ~]# cat /usr/local/bin/authy-ssh.conf
banner=Good job! You've securely logged in with Authy.
load_default_banner=enable
api_key=05c783f2db87b73b198f11fe45dd8bfb
user=root:1
user=daniel:1
user=root:1:-1
user=daniel:1:300

In this case it means user root and daniel have two-factor enabled and that 1 is their `authy_id`. If a user is not in this list, `authy-ssh` will automatically let him in.
The user daniel has an optional `grace-period` of 300 seconds, allowing them to open a new session within 5 minutes of the last successful login without requiring two-factor authentication.
On the other hand, the root user uses the default `grace-period` of -1, requiring all sessions to use two-factor authentication, regardless of recent successful logins.

The `load_default_banner` option will show the operating system's default SSH banner when a successful login occurs. This checks to see if a MOTD is set in /etc/pam.d/sshd or /etc/motd.
Setting this to disable will suppress the default sshd MOTD.

## Using two-factor auth with automated deployment tools.

Expand Down Expand Up @@ -144,8 +150,8 @@ and then for each person add their ssh key using the following command:

you should end up with an authorized_keys file that looks like:

command="/usr/local/bin/authy-ssh login 13386" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGRJbWu+WLVXYVADY3iQPE1kA7CIOSqHmskPM8qIAzKzq+1eRdmPwDZNmAvIQnN/0N7317Rt1bmTRLBwhl6vfSgL6677vUwsevPo27tIxdja67ELTh55xVLcJ3O8x2qkZsySgkLP/n+w3MUwLe1ht31AZOAsV7J7imhWipDijiysNgvHyeSWsHqExaL1blPOYJVHcqPbKY4SxFRq/MWeyPf/Sm24MFSKEaY6u0kNx8MLJ1X9X/YxmY9rdvzsZdQ7Z/PYhYt2Ja/0mzfYx2leeP2JQBsVfZZzAoFEPpw6mSP9kJREGe2tXvS9cRenhz/+V0+mvSJKG0f0Zzh428pTzN
command="/usr/local/bin/authy-ssh login 20" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyvj2d0rSDukDT04mK7njUxtXffUrOnDCm2Bqub0zN7LQS733nBHp89aMuBI5ENjw1SQ2qXhLxvK1Xhr0pQr+dOWNn3emQjQuiA+YL39yp2RLLpflerJ3KAVY09CHYLFxdKj/DJgXsH+LMAPe2uVmWCP2xAV5ZcLnz3CdS2SX/EVlbNrftesZx9uAbmwKPLY1pmW7q/75AhJRow8VTP7zM/VS7jEHkj03g51BZGB8tMI3G8RDVEDtu2jVwZiq+8BaNCyjYVlsLfu6uGhnXeeUS3swu/atlt+pxy+QTf/HGvrJR58tER+foqheWtV3LqXN4oLckzqTVkDDmnNJlmrpYQ==
command="/usr/local/bin/authy-ssh login 13386 -1" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGRJbWu+WLVXYVADY3iQPE1kA7CIOSqHmskPM8qIAzKzq+1eRdmPwDZNmAvIQnN/0N7317Rt1bmTRLBwhl6vfSgL6677vUwsevPo27tIxdja67ELTh55xVLcJ3O8x2qkZsySgkLP/n+w3MUwLe1ht31AZOAsV7J7imhWipDijiysNgvHyeSWsHqExaL1blPOYJVHcqPbKY4SxFRq/MWeyPf/Sm24MFSKEaY6u0kNx8MLJ1X9X/YxmY9rdvzsZdQ7Z/PYhYt2Ja/0mzfYx2leeP2JQBsVfZZzAoFEPpw6mSP9kJREGe2tXvS9cRenhz/+V0+mvSJKG0f0Zzh428pTzN
command="/usr/local/bin/authy-ssh login 20 300" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyvj2d0rSDukDT04mK7njUxtXffUrOnDCm2Bqub0zN7LQS733nBHp89aMuBI5ENjw1SQ2qXhLxvK1Xhr0pQr+dOWNn3emQjQuiA+YL39yp2RLLpflerJ3KAVY09CHYLFxdKj/DJgXsH+LMAPe2uVmWCP2xAV5ZcLnz3CdS2SX/EVlbNrftesZx9uAbmwKPLY1pmW7q/75AhJRow8VTP7zM/VS7jEHkj03g51BZGB8tMI3G8RDVEDtu2jVwZiq+8BaNCyjYVlsLfu6uGhnXeeUS3swu/atlt+pxy+QTf/HGvrJR58tER+foqheWtV3LqXN4oLckzqTVkDDmnNJlmrpYQ==

The previous command will ask you the user ssh public key, cellphone and email.

Expand All @@ -159,7 +165,7 @@ To uninstall type:

## Running Unit Tests

Fork and clone the git repository https://github.com/authy/authy-ssh.git
Fork and clone the git repository https://github.com/DigitalDJ/authy-ssh.git

$ cd tests
$ rake test
Loading