Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #226161 > unrolled thread

add 2FA to ssh

Back to article view | Back to linux.debian.user

Contents

  add 2FA to ssh Pòl Hallen <deben@fuckaround.org> - 2020-08-13 13:40 +0200
    Re: add 2FA to ssh Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-13 13:50 +0200
      Re: add 2FA to ssh Nicholas Geovanis <nickgeovanis@gmail.com> - 2020-08-13 16:50 +0200
        Re: add 2FA to ssh Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-13 17:20 +0200
      Re: add 2FA to ssh Thomas Pircher <thp+debian@p5r.uk> - 2020-08-13 18:40 +0200
        Re: add 2FA to ssh Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-14 14:40 +0200
          Re: add 2FA to ssh Thomas Pircher <thp+debian@p5r.uk> - 2020-08-14 19:20 +0200
    Re: add 2FA to ssh Toni Mas Soler <antomassol@gmail.com> - 2020-08-13 16:30 +0200
      Re: add 2FA to ssh James Allsopp <jamesaallsopp@googlemail.com> - 2020-08-13 16:50 +0200

#226161 — add 2FA to ssh

Hi folks :)


what it better with 2FA: at ssh login request first 2FA authentication 
next ssh password or viceversa?

thanks!

Pol

[toc] | [next] | [standalone]

#226162

On Thu, Aug 13, 2020 at 01:37:39PM +0200, Pòl Hallen wrote:
> Hi folks :)
> 
> 
> what it better with 2FA: at ssh login request first 2FA authentication next
> ssh password or viceversa?
> 
> thanks!
> 
> Pol
>


sorry to say, but 2FA is again one of the hype things. Why do you need 2FA
for ssh. I mean a really good reason.
Maintain a good keychain and you wont need 2FA.

-H

-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#226168

[Multipart message — attachments visible in raw view] — view raw

On Thu, Aug 13, 2020, 6:47 AM Henning Follmann <hfollmann@itcfollmann.com>
wrote:

> On Thu, Aug 13, 2020 at 01:37:39PM +0200, Pòl Hallen wrote:
> > Hi folks :)
>
> >
> > what it better with 2FA: at ssh login request first 2FA authentication
> next
> > ssh password or viceversa?
> >
> > thanks!
> >
> > Pol
>
> sorry to say, but 2FA is again one of the hype things. Why do you need 2FA
> for ssh. I mean a really good reason.
> Maintain a good keychain and you wont need 2FA.
>

The usual reason is an out-of-band or hardware-based one-time pad. The
additional password is for that session only.

-H
>
> --
> Henning Follmann           | hfollmann@itcfollmann.com
>
>

[toc] | [prev] | [next] | [standalone]

#226169

On Thu, Aug 13, 2020 at 09:39:43AM -0500, Nicholas Geovanis wrote:
> On Thu, Aug 13, 2020, 6:47 AM Henning Follmann <hfollmann@itcfollmann.com>
> wrote:
> 
> > On Thu, Aug 13, 2020 at 01:37:39PM +0200, Pòl Hallen wrote:
> > > Hi folks :)
> >
> > >
> > > what it better with 2FA: at ssh login request first 2FA authentication
> > next
> > > ssh password or viceversa?
> > >
> > > thanks!
> > >
> > > Pol
> >
> > sorry to say, but 2FA is again one of the hype things. Why do you need 2FA
> > for ssh. I mean a really good reason.
> > Maintain a good keychain and you wont need 2FA.
> >
> 
> The usual reason is an out-of-band or hardware-based one-time pad. The
> additional password is for that session only.
> 

That is not a reason. This is "how".
The "session only" I kind of get though.
But still. Currently everyone is pushing 2FA and most of the time
the implementation sucks or there is no good reason for it.
And for ssh a password protected keychain is the reasonable
way to go.

-H

-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#226171

Henning Follmann wrote:
> Maintain a good keychain and you wont need 2FA.

I'm curious, What do you mean by keychain in context of ssh? The
application of that name or something else?

Thomas

[toc] | [prev] | [next] | [standalone]

#226192

On Thu, Aug 13, 2020 at 05:38:04PM +0100, Thomas Pircher wrote:
> Henning Follmann wrote:
> > Maintain a good keychain and you wont need 2FA.
> 
> I'm curious, What do you mean by keychain in context of ssh? The
> application of that name or something else?
> 
> Thomas
>

Either keys generated thru ssh-genkey or if you use
gnupg to manage your keys.
gnupg has the advantage that you could use
a gnupg card to store your keys.

I use keychain very liberal here, sorry.


-H


-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#226196

Henning Follmann wrote:
> Either keys generated thru ssh-genkey or if you use
> gnupg to manage your keys.
> gnupg has the advantage that you could use
> a gnupg card to store your keys.

Thanks for the clarification, it was purely out of interest. As someone
who has discovered ssh CAs only relatively recently I thought there were
some other features I was missing out on.

Thomas

[toc] | [prev] | [next] | [standalone]

#226166

I think 2FA first is better. Thus you don't have to type your password
if you have a wrong 2FA.

Toni Mas

Missatge de Pòl Hallen <deben@fuckaround.org> del dia dj., 13 d’ag.
2020 a les 13:38:
>
> Hi folks :)
>
>
> what it better with 2FA: at ssh login request first 2FA authentication
> next ssh password or viceversa?
>
> thanks!
>
> Pol
>

[toc] | [prev] | [next] | [standalone]

#226167

[Multipart message — attachments visible in raw view] — view raw

Hi,
You can do it at the same time with a yubikey and editing your pam file.

https://developers.yubico.com/yubico-pam/YubiKey_and_SSH_via_PAM.html#:~:text=The%20Yubico%20PAM%20module%20for,YubiKey%20assigned%20to%20the%20user.


Been doing this for years,
James

On Thu, 13 Aug 2020 at 15:24, Toni Mas Soler <antomassol@gmail.com> wrote:

> I think 2FA first is better. Thus you don't have to type your password
> if you have a wrong 2FA.
>
> Toni Mas
>
> Missatge de Pòl Hallen <deben@fuckaround.org> del dia dj., 13 d’ag.
> 2020 a les 13:38:
> >
> > Hi folks :)
> >
> >
> > what it better with 2FA: at ssh login request first 2FA authentication
> > next ssh password or viceversa?
> >
> > thanks!
> >
> > Pol
> >
>
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web