Mdthbs

Does Windows 10 Fast Startup feature drain battery while laptop is turned off?

one-liner vs script

How to execute a project with two resources where you need three resources?

How effective are nunchaku as a choking weapon?

How to discipline overeager engineer

How to make "acts of patience" exciting?

Should a grammatical article be a part of a web link anchor

Test if two food are the same

I'm largest when I'm five, what am I?

Does Australia produce unique 'specialty steel'?

Can a successful economy exist without renting stuff?

Why do previous versions of Debian packages vanish in the package repositories? (highly relevant for version-controlled system configuration)

An employee has low self-confidence, and is performing poorly. How can I help?

Why is lying to Congress a crime?

Little Endian Number to String Conversion

How to temporarily replace Latin characters with Greek

Why did a young George Washington sign a document admitting to assassinating a French military officer?

What does IKEA-like mean?

Can I use I2C over 2m cables?

D&D Monsters and Copyright

What is this cast-iron device on my water supply pipe?

How to make a gift without seeming creepy?

Are there any privately owned large commercial airports?

Is there a way to make a Minor key sound "less dark"?

Configure PAM to ask for 2FA token even if password is incorrect

Why does pam_mount ask for password?Replacement for php5-auth-pam to authenticate website login against local usersHow to allow unauthenticated logins over ssh on FreeBSD?Can SSH public key authentication use pam_group?Determine which name service created entry in database (eg passwd)?How PAM determines system password and 2FA OTP

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{
margin-bottom:0;
}

0

I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the password given is incorrect, though, then it will keep asking for the password. This obviously would reveal to an attacker that they have actually discovered the password, even if they can't get in immediately.

For example, if the password is hunter2:

Password: hunter2

Verification code: 

vs

Password: banana

Password:

I'd like to set it up so that it asks for the 2FA code in every instance, even when the password is wrong, to close off this attack vector. I'd also like it to send me an alert if the correct password is entered along with an incorrect OTP.

Is this something I can achieve with PAM configuration or would I need to basically write my own module for it?

ssh security pam 2-factor-authentication

share|improve this question

asked 1 hour ago

xereetoxereeto

1

New contributor

xereeto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What is your current PAM configuration?
  
  – muru
  1 hour ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I just added auth required pam_google_authenticator.so to the top of the PAM config file. In the ssh config I have UsePAM yes, PasswordAuthentication no, ChallengeResponseAuthentication yes, and AuthenticationMethods publickey keyboard-interactive.
  
  – xereeto
  29 mins ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Please show the current PAM configuration.
  
  – muru
  21 mins ago
  

  
  
  
  

add a comment
 | 

0

I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the password given is incorrect, though, then it will keep asking for the password. This obviously would reveal to an attacker that they have actually discovered the password, even if they can't get in immediately.

For example, if the password is hunter2:

Password: hunter2

Verification code: 

vs

Password: banana

Password:

I'd like to set it up so that it asks for the 2FA code in every instance, even when the password is wrong, to close off this attack vector. I'd also like it to send me an alert if the correct password is entered along with an incorrect OTP.

Is this something I can achieve with PAM configuration or would I need to basically write my own module for it?

ssh security pam 2-factor-authentication

share|improve this question

asked 1 hour ago

xereetoxereeto

1

New contributor

xereeto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What is your current PAM configuration?
  
  – muru
  1 hour ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I just added auth required pam_google_authenticator.so to the top of the PAM config file. In the ssh config I have UsePAM yes, PasswordAuthentication no, ChallengeResponseAuthentication yes, and AuthenticationMethods publickey keyboard-interactive.
  
  – xereeto
  29 mins ago
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Please show the current PAM configuration.
  
  – muru
  21 mins ago
  

  
  
  
  

add a comment
 | 

I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the password given is incorrect, though, then it will keep asking for the password. This obviously would reveal to an attacker that they have actually discovered the password, even if they can't get in immediately.

For example, if the password is hunter2:

Password: hunter2

Verification code: 

vs

Password: banana

Password:

I'd like to set it up so that it asks for the 2FA code in every instance, even when the password is wrong, to close off this attack vector. I'd also like it to send me an alert if the correct password is entered along with an incorrect OTP.

Is this something I can achieve with PAM configuration or would I need to basically write my own module for it?

ssh security pam 2-factor-authentication

share|improve this question

asked 1 hour ago

xereetoxereeto

1

New contributor

xereeto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

Password: hunter2

Verification code: 

Password: banana

Password:

share|improve this question

asked 1 hour ago

xereetoxereeto

1

New contributor

xereeto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

asked 1 hour ago

xereetoxereeto

1

New contributor

xereeto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 1 hour ago

xereetoxereeto

1

New contributor

xereeto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 1 hour ago

xereetoxereeto

1