# google-authenticator 的认证配置 [root@beijing ~]# google-authenticator # 是否需要开启OTP Do you want authentication tokens to be time-based (y/n) y # 因为网络原因会报一个fail的错误 Warning: pasting the following URL into your browser exposes the OTP secret to Google: https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@beijing%3Fsecret%3D7ZA2DON54L6RRA3XST4XCOZ3PE%26issuer%3Dbeijing # 此处应当加载一个二维码图片来实现手机扫码 Failed to use libqrencode to show QR code visually for scanning. Consider typing the OTP secret into your app manually. # 需要把下面的key手动添加到手机或者其他版本的OTP工具中去 Your new secret key is: 7ZA2DON54L6RRA3XST4XCOZ3PE Enter code from app (-1 to skip): 284247 Code confirmed # 应急密码 Your emergency scratch codes are: 41512988 16324046 36557372 11539062 54599229 # 是否更新 Do you want me to update your "/root/.google_authenticator" file? (y/n) y # 是否禁止同一验证码多次使用 Do you want to disallow multiple uses of the same authentication token? This restricts you to one login about every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) y # 是否允许使用过期验证码 By default, a new token is generated every 30 seconds by the mobile app. In order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. This allows for a time skew of up to 30 seconds between authentication server and client. If you experience problems with poor time synchronization, you can increase the window from its default size of 3 permitted codes (one previous code, the current code, the next code) to 17 permitted codes (the 8 previous codes, the current code, and the 8 next codes). This will permit for a time skew of up to 4 minutes between client and server. Do you want to do so? (y/n) y # 是否限制尝试频率，减少SSH爆破风险 If the computer that you are logging into isn't hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting? (y/n) y # 系统的PAM模块加载 echo "auth required pam_google_authenticator.so nullok" >>/etc/pam.d/sshd sed -i 's/auth substack password-auth/# auth substack password-auth/g' /etc/pamd.d/sshd # 配置仅使用证书和OTP认证 echo "AuthenticationMethods publickey,keyboard-interactive" >>/etc/ssh/sshd_config sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' /etc/ssh/sshd_config.d/50-redhat.conf # 配置某个用户使用密码和OTP认证 Match user sujx AuthenticationMethods password,keyboard-interactive # 重启SSHD服务 systemctl restart sshd
