Pam modul pro 2FA na https://2fa.adminit.cz/

Hodnoty v ramci client_id a client_token jsou v k dostani v ramci projektu na administraci 2FA.

Nastaveni jen pro hesla:

$ cat /etc/sshd_config.d/10-ait-2fa.conf
PermitRootLogin yes
ChallengeResponseAuthentication yes
KbdInteractiveAuthentication yes
AuthenticationMethods keyboard-interactive:pam

pred:
$ cat /etc/pam.d/sshd
@include common-auth

po:
$ cat /etc/pam.d/sshd
#@include common-auth
auth  [success=1 default=ignore] pam_unix.so nullok
auth  requisite pam_deny.so
auth  [success=1 default=ignore] pam_opensesame.so client_id=A client_token=A url=https://2fa.adminit.cz/api/authRequest2fa
auth  requisite pam_deny.so
auth  required pam_permit.so

Nastaveni jen pro klice:

$ cat /etc/sshd_config.d/10-ait-2fa.conf
PermitRootLogin yes
Match User root
   PasswordAuthentication no
ChallengeResponseAuthentication yes
KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam

pred:
$ cat /etc/pam.d/sshd
@include common-auth

po:
$ cat /etc/pam.d/sshd
#@include common-auth
auth  [success=1 default=ignore] pam_exec.so quiet /usr/local/sbin/ssh-pubkey-check
auth  requisite pam_deny.so
auth  [success=1 default=ignore] pam_opensesame.so client_id=A client_token=A url=https://2fa.adminit.cz/api/authRequest2fa
auth  requisite pam_deny.so
auth  required pam_permit.so

$ cat /usr/local/sbin/ssh-pubkey-check
#!/usr/bin/perl

if ($ENV{'SSH_AUTH_INFO_0'} =~ /^publickey /) {
    exit(0);
} else {
    exit(1);
}

Nastaveni klice a hesla:

$ cat /etc/sshd_config.d/10-ait-2fa.conf
PermitRootLogin yes
Match User root
   PasswordAuthentication no
ChallengeResponseAuthentication yes
KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam

pred:
$ cat /etc/pam.d/sshd
@include common-auth

po:
$ cat /etc/pam.d/sshd
#@include common-auth
auth  [success=2 default=ignore] pam_exec.so quiet /usr/local/sbin/ssh-pubkey-check
auth  [success=1 default=ignore] pam_unix.so nullok
auth  requisite pam_deny.so
auth  [success=1 default=ignore] pam_opensesame.so client_id=A client_token=A url=https://2fa.adminit.cz/api/authRequest2fa
auth  requisite pam_deny.so
auth  required pam_permit.so

$ cat /usr/local/sbin/ssh-pubkey-check
#!/usr/bin/perl

if ($ENV{'SSH_AUTH_INFO_0'} =~ /^publickey /) {
    exit(0);
} else {
    exit(1);
}

Pri prihlasovani pomoci hesla se bere jmeno daneho uzivatele, ktery se prihlasuje.
Pokud je prihlasovani pomoci verejeneho klice tak najde jmeno klice v ramci souboru v home uzivatele ~/.ssh/authorized_keys a pokud za klicem neni jmeno pouzije se jmeno uzivatele.
