linux google Authenticator

linux google Authenticator

yum install -y chrony
vim /etc/chrony.conf
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

systemctl restart chronyd

chronyc sources

安装依赖组件

 yum install -y git automake libtool pam-devel

下载谷歌认证模块

git clone https://github.com/google/google-authenticator-libpam.git

安装谷歌认证模块

cd google-authenticator-libpam/
./bootstrap.sh
./configure
 make && make install

修改pam配置文件

 vim /etc/pam.d/sshd
 auth       required     pam_google_authenticator.so

修改sshd配置文件

vim /etc/ssh/sshd_config
asswordAuthentication yes

重启sshd

systemctl restart sshd

执行初始化谷歌认证模块

google-authenticator

Do you want authentication tokens to be time-based (y/n) y
#你想做的认证令牌是基于时间的吗？
Do you want me to update your “/root/.google_authenticator” file? (y/n) y
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y
If the computer that you are logging into isn’t hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y

查看日志信息

tail -n10 /var/log/secure

配置手机app