Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Adds sshd config for keyboard-interactive pam device #156

Merged
merged 1 commit into from
Apr 20, 2018
Merged

Adds sshd config for keyboard-interactive pam device #156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
|`ssh_client_password_login` | false | `true` to allow password-based authentication with the ssh client |
|`ssh_server_password_login` | false | `true` to allow password-based authentication with the ssh server |
|`ssh_google_auth` | false | `true` to enable google authenticator based TOTP 2FA |
|`ssh_pam_device` | false | `true` to enable public key auth with pam device 2FA |
|`ssh_banner` | `false` | `true` to print a banner on login |
|`ssh_client_hardening` | `true` | `false` to stop harden the client |
|`ssh_client_port` | `'22'` | Specifies the port number to connect on the remote host. |
Expand Down
3 changes: 3 additions & 0 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ ssh_use_pam: false # sshd
# false to disable google 2fa authentication
ssh_google_auth: false # sshd

# false to disable pam device 2FA input
ssh_pam_device: false # sshd

# if specified, login is disallowed for user names that match one of the patterns.
ssh_deny_users: '' # sshd

Expand Down
5 changes: 5 additions & 0 deletions templates/opensshd.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,11 @@ UsePAM {{ 'yes' if (ssh_use_pam|bool) else 'no' }}
AuthenticationMethods publickey,keyboard-interactive
{% endif %}

# Force public key auth then ask for pam device input
{% if ssh_pam_device %}
AuthenticationMethods publickey,keyboard-interactive:pam
Copy link
Member

@rndmh3ro rndmh3ro Apr 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have almost the same configuration on lines 96-98, except for the :pam-part. What's the difference between these two? Are both needed?

Copy link
Contributor Author

@rcII rcII Apr 16, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rndmh3ro the added :pam option only allows authentication from the PAM (yubikey) device itself. From the sshd docs:

	     For keyboard interactive authentication it	is also	possible to
	     restrict authentication to	a specific device by appending a colon
	     followed by the device identifier ``bsdauth'', ``pam'', or
	     ``skey'', depending on the	server configuration.  For example,
	     ``keyboard-interactive:bsdauth'' would restrict keyboard interac-
	     tive authentication to the	``bsdauth'' device.

(Sorry for the crappy formatting). Source: https://www.freebsd.org/cgi/man.cgi?query=sshd_config&sektion=5.
Regarding ChallengeResponseAuthentication and UsePam, this is the mechanism that prompts a challenge response via the PAM interface. The excepted "2FA" outcome is as follows.

  1. Authenticate via ssh public key first.
  2. Prompt a challenge response from PAM device (Yubikey).
    The user will be prompted as follows:
YubiKey for `foouser':

Copy link
Member

@rndmh3ro rndmh3ro Apr 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your explanation!

{% endif %}

# Disable password-based authentication, it can allow for potentially easier brute-force attacks.
PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
PermitEmptyPasswords no
Expand Down