我使用的是 Debian 12，正在尝试使用 pubkey 和 TOTP 设置 pam_google_authenticator.so 以用于 SSH 2fa。
我使用 google-authenticator 完成设置并输入我的令牌给我的 2FA 代码，它成功了。但输入密码失败。
设置：
$ google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/itadmin@server01%3Fsecret%xxxxxxxxxxxxxxxxxxxxxxxxxxx%26issuer%3Dserver01
Your new secret key is: xxxxxxxxxxxxxxxxxxxxxxxxxxx
Enter code from app (-1 to skip): xxxxxx
Code confirmed
Your emergency scratch codes are:
xxxxxxxx
xxxxxxxx
xxxxxxxx
xxxxxxxx
xxxxxxxx
Do you want me to update your "/home/itadmin/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) n
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
$ ls -lisa
total 28
783373 4 drwxr-xr-x 3 itadmin itadmin 4096 Aug 9 19:15 .
783364 4 drwxr-xr-x 4 root root 4096 Aug 9 18:40 ..
783392 4 -rw-r--r-- 1 itadmin itadmin 220 Aug 4 2021 .bash_logout
783393 4 -rw-r--r-- 1 itadmin itadmin 1811 Aug 9 18:43 .bashrc
783396 4 -r-------- 1 itadmin itadmin 119 Aug 9 19:15 .google_authenticator
783391 4 -rw-r--r-- 1 itadmin itadmin 807 Aug 4 2021 .profile
783394 4 drwxr-xr-x 2 itadmin itadmin 4096 Aug 9 18:40 .ssh
然后我对 sshd_config 和 pam sshd 进行修改：
/etc/pam.d/sshd
# PAM configuration for the Secure Shell service
# Standard Un*x authentication.
@include common-auth
# Disallow non-root logins when /etc/nologin exists.
account required pam_nologin.so
# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so
# Standard Un*x authorization.
@include common-account
# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
# Set the loginuid process attribute.
session required pam_loginuid.so
# Create a new session keyring.
session optional pam_keyinit.so force revoke
# Standard Un*x session setup and teardown.
@include common-session
# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate
# Print the status of the user's mailbox upon successful login.
session optional pam_mail.so standard noenv # [1]
# Set up user limits from /etc/security/limits.conf.
session required pam_limits.so
# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context. Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
# 2FA TOTP Authentication
auth required pam_google_authenticator.so
/etc/ssh/sshd_config
#General Options
Port 22
AddressFamily inet
ListenAddress 0.0.0.0
Protocol 2
#
#Crypto Options
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
#
#Authentication:
PermitRootLogin no
LoginGraceTime 2m
StrictModes yes
MaxAuthTries 3
MaxSessions 6
rekeylimit 500M 1h
#
#Other Auth Options
UsePAM yes
GSSAPIAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
PermitEmptyPasswords no
#
#Key Authentication
AuthorizedKeysFile .ssh/authorized_keys
PubkeyAuthentication yes
PasswordAuthentication no
#
#MISC OPTIONS
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
GatewayPorts no
X11Forwarding no
PermitTTY yes
TCPKeepAlive no
PermitUserEnvironment no
Compression yes
ClientAliveInterval 300
ClientAliveCountMax 3
UseDNS no
PidFile /var/run/sshd.pid
MaxStartups 10:50:40
PrintLastLog no
PrintMotd no
VersionAddendum none
Banner none
DebianBanner no
#
#Chroot Options
#ChrootDirectory none
#
#Match Blocks
Match Address 192.168.0.2
AllowUsers itadmin
但是当 sshing 并输入当前的 2fa 代码时，“密码”失败：
$ ssh server01
([email protected]) Password:
([email protected]) Password:
([email protected]) Password:
Received disconnect from 192.168.0.24 port 22:2: Too many authentication failures
Disconnected from 192.168.0.24 port 22
$
SSH 客户端配置供参考：
Host server01
Hostname 192.168.0.24
User itadmin
IdentityFile ~/.ssh/servers.priv
IdentitiesOnly yes
2fa 代码最初在模块测试中成功，但现在登录时失败？
其他一切正常，当我注释掉该AuthenticationMethods publickey,keyboard-interactive行sshd_config并重新启动服务时，我可以从客户端正常登录。
当用户登录时，pam 的身份验证模块是否从用户主目录中的文件读取，或者这只是一个副本，设置实际上存储在其他地方？
这里出了什么问题？？