GNU/Linux >> Linux Esercitazione >  >> Linux

Ssh:richiede solo l'autenticazione di Google da una rete locale esterna?

Esecuzione di una variante debian (osmc)

Cosa sto cercando di fare:

  • Disabilita ssh tramite password, richiedendo sia la chiave che l'autenticatore di Google; Funziona tutto
  • Ma ora sto cercando di richiedere l'autenticazione a 2 fattori solo dall'esterno della rete locale (è più facile per
    script di backup ma se c'è un altro modo migliore per farlo, per favore
    dillo)

Attualmente sto usando stucco e spettacolo da una finestra di Windows per testare, nel caso sia rilevante

Quindi sto usando la soluzione qui:https://serverfault.com/questions/799657/ssh-google-authenticator-ignore-whitelist-ips

Cosa sta succedendo ora –
Quando mi collego dall'esterno della rete, è ancora richiesta l'autenticazione a 2 fattori come richiesto
Dall'interno della rete sembra che riconosca la chiave ma poi si verifica un errore con "Ulteriore autenticazione richiesta".

Molte grazie in anticipo per qualsiasi aiuto

sudo systemctl status ssh

Aug 25 19:51:36 mosmc sshd[10528]: error: PAM: Permission denied for osmc from beast
Aug 25 19:51:36 mosmc sshd[10528]: Failed keyboard-interactive/pam for osmc from 192.168.21.3 port 54330 ssh2
Aug 25 19:51:36 mosmc sshd[10528]: error: Received disconnect from 192.168.21.3: 14: No supported authentication methods available [preauth]

Cat of files di seguito (dove menziona uno script che ho appena scritto per l'installazione di questo media box mentre il mio pasticcio continua a romperlo)

    [email protected]:~$ cat /etc/ssh/sshd_config
# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port XXXXXXX #changed by sshinstall
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2

# Inserted hostkeys by ssh-install script
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
#End of inserted code
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel VERBOSE #edited by script

# Inserted ftp by ssh-install script
# Log sftp level file access (read/write/etc.) that would not be easily logged otherwise.
Subsystem internal-sftp  /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO
#End of inserted code

# Authentication:
LoginGraceTime 120
PermitRootLogin no #edited by script
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication yes #edited by script

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no #edited by script

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*


# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of PermitRootLogin without-password
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.

# Inserted google-auth settings by ssh-install script
AuthenticationMethods publickey,keyboard-interactive:pam
KbdInteractiveAuthentication yes
# Ensure /bin/login is not used so that it cannot bypass PAM settings for sshd.
UseLogin no
#End of inserted code
UsePAM yes

access-local.conf

[email protected]:~$ cat /etc/security/access-local.conf
# only allow from local IP range
+ : ALL : 192.168.21.0/24
+ : ALL : LOCAL
- : ALL : ALL

pam.d

[email protected]:~$ cat /etc/pam.d/sshd
# PAM configuration for the Secure Shell service

# Inserted PAM settings by ssh-install script
auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth required pam_google_authenticator.so
#End of inserted code

# Standard Un*x authentication.
#@include common-auth #commented out  by sshinstall

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# SELinux needs to be the first session rule.  This ensures that any
# lingering context has been cleared.  Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close

# Set the loginuid process attribute.
session    required     pam_loginuid.so

# Create a new session keyring.
session    optional     pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session    optional     pam_motd.so  motd=/run/motd.dynamic
session    optional     pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session    required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context.  Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open

# Standard Un*x password updating.
@include common-password

Risposta accettata:

auth [success=done default=ignore] pam_access.so accessfile=/etc/security/access-local.conf

Sembra essere la risposta. Modifica questo mentre imparo di più.

Correlati:Ubuntu - Come uscire da ssh quando si blocca?

Da http://linux-pam.org/Linux-PAM-html/sag-configuration-file.html

successo=fatto

done
equivale a ok con l'effetto collaterale di terminare il modulo
stack e PAM tornare immediatamente all'applicazione.

default=ignora

ignora
se utilizzato con uno stack di moduli, lo stato di ritorno del modulo non contribuirà al codice di ritorno ottenuto dall'applicazione.

da – https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files#134488

success=1 salta una riga.

Se qualcun altro vuole scrivere una risposta migliore che spieghi cosa sta succedendo, lo accetterò felicemente.

Grazie a Hostfission per avermi indicato la parte giusta.


Linux
  1. Ssh – Script per automatizzare Scp in rete?

  2. Impedire a Tmux di avviarsi su Ssh?

  3. Come accedere al server Ubuntu in esecuzione in Virtualbox dall'esterno?

  4. Come inviare dati agli appunti locali da una sessione SSH remota

  5. Come creare un terminale basato sul Web utilizzando xterm.js per ssh in un sistema sulla rete locale

Comando SCP Linux – Come trasferire file SSH da remoto a locale

Come SSH su Linux da Android

Ssh 7.4 Pausa prolungata a "pledge:Network"?

Ottenere gli indirizzi dell'interfaccia di rete locale utilizzando solo proc?

Limita rsync su ssh sola lettura/solo copia da host remoto

Consentire l'accesso a un host virtuale Apache solo dalla rete locale