使用 google_authenticator 生成动态密码加固 ssh 登陆

1

dnf install google-authenticator openssh-server -y

1
2

sed -i.bak 's/archive.ubuntu.com/mirrors.ustc.edu.cn/g' /etc/apt/sources.list
apt update && apt install libpam-google-authenticator openssh-server -y

1

apk add google-authenticator openssh-server-pam

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

root@2a52e5dc9569:/# google-authenticator

Do you want authentication tokens to be time-based (y/n) y
 <这里是自动生成的二维码及链接，可以扫码绑定手机 app >
Your new secret key is: 2MX4BZPDXZONH6SVUPMUC3SO5M    (用于绑定手机 app 的密钥)
Your verification code is 768806                      (验证码)
Your emergency scratch codes are:                     (备用令牌码，用一个少一个)
  43344880
  98680948
  43923070
  26622686
  60782611

Do you want me to update your "/root/.google_authenticator" file? (y/n) y
(是否覆盖 "/root/.google_authenticator" 文件，如果之前生成过文件需要谨慎确认)

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
(是否拒绝多次使用使用相同的令牌？这将限制你每30s仅能登录一次，但会提醒/阻止中间人攻击。)

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) n
(是否将窗口时间由1分30秒增加到约4分钟？这将缓解时间同步问题。)

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
(是否启用此模块的登录频率限制，登录者将会被限制为最多在30秒内登录3次。)

1

sed -i.bak '1i UsePAM yes\nChallengeResponseAuthentication yes' /etc/ssh/sshd_config

1

sed -i.bak '1i auth            sufficient      pam_google_authenticator.so' /etc/pam.d/sshd

1
2
3
4
5

echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config  ## 允许 root 用户登陆
ssh-keygen -A       # 生成服务器 key
mkdir /run/sshd     # 创建运行环境目录
hostname -I         # 拿到容器 IP
/usr/sbin/sshd -d   # 前台运行 sshd 服务

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

ssh -v 172.17.0.1
... ...              (公钥验证)
ECDSA key fingerprint is SHA256:/9Z8rQasLV5qsSVfwMc+vsvanpNpoWYd2B2c31Uc6lk.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.17.0.6' (ECDSA) to the list of known hosts.
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Trying private key: /root/.ssh/id_xmss
debug1: Next authentication method: keyboard-interactive
Verification code: <输入手机上动态密码>
Password: <系统内对应用户密码>

1
2

sed -i.bak '1i UsePAM yes\nChallengeResponseAuthentication yes' /etc/ssh/sshd_config               # 确保打开 pam 支持 和 交互式验证
sed -i.bak '1i auth            sufficient      pam_google_authenticator.so' /etc/pam.d/sshd  # pam 中添加 google_authenticator 验证模块