PAM和google模块实现ssh双因子安全验证。

安装需要使用的双因子模块

[root@localhost ~]# yum install google-authenticator

使用认证双因子

Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
  https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@localhost.localdomain%3Fsecret%3DTBCVYR3QDV46YHDJURSEETO4ME%26issuer%3Dlocalhost.localdomain
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: TBCVYR3QDV46YHDJURSEETO4ME
Enter code from app (-1 to skip): 298625
Code confirmed
Your emergency scratch codes are:
  14710139
  17966808
  71824116
  27560988
  20685451

Do you want me to update your "/root/.google_authenticator" file? (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y

If the computer that you are logging into isn t hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
sed: -e expression #1, char 69: unterminated `s  command
Redirecting to /bin/systemctl restart sshd.service

验证登录

[root@localhost ~]# ssh 192.168.103.81
Verification code: 
Password: 
Last failed login: Sat Mar 20 19:41:30 CST 2021 from 192.168.103.71 on ssh:notty
There were 4 failed login attempts since the last successful login.
Last login: Sat Mar 20 19:35:42 2021 from 10.255.255.13