![我想要的配置可行吗?使用 google 身份验证 2fa SSH 到 Redhat 服务器时出现问题](https://linux22.com/image/724380/%E6%88%91%E6%83%B3%E8%A6%81%E7%9A%84%E9%85%8D%E7%BD%AE%E5%8F%AF%E8%A1%8C%E5%90%97%EF%BC%9F%E4%BD%BF%E7%94%A8%20google%20%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81%202fa%20SSH%20%E5%88%B0%20Redhat%20%E6%9C%8D%E5%8A%A1%E5%99%A8%E6%97%B6%E5%87%BA%E7%8E%B0%E9%97%AE%E9%A2%98.png)
我尝试在使用 SSH 连接到我的 redhat ec2 实例时配置双因素身份验证。
我想这样配置它:
- 如果用户同时设置了 ssh 密钥和 google 身份验证,请使用这两个因素
- 如果用户没有 ssh 密钥,请使用密码和 google auth
- 如果用户只有密码,这就足够了
我已经使它部分工作了,但是在当前配置下,我现在面临的问题是:
- 仅设置了密码的用户会被提示输入两次密码,但仍被授予访问权限(这不是我主要关心的问题)
- 配置了 google 身份验证器的用户会被提示输入密码,输入密码后会提示输入验证码。如果您输入了错误的验证码,系统会再次提示您输入密码,这样您无需输入验证码即可访问,google 身份验证器将失去作用。
我的配置设置:
sshd 配置文件
#%PAM-1.0
auth required pam_sepermit.so
auth [success=done new_authtok_reqd=ok default=ignore] pam_google_authenticator.so nullok
auth substack password-auth
auth include postlogin
account required pam_sepermit.so
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include password-auth
session include postlogin
/etc/ssh/sshd_config
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTHPRIV
PermitRootLogin no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
ChallengeResponseAuthentication yes
GSSAPIAuthentication no
GSSAPICleanupCredentials no
UsePAM yes
X11Forwarding yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem sftp /usr/libexec/openssh/sftp-server
Match all
AuthenticationMethods publickey,keyboard-interactive:pam password,keyboard-interactive:pam