Two-Factor Authentication - Revision history

Merenber: /* PAM config */

2021-10-09T06:10:36Z

PAM config

← Older revision		Revision as of 01:10, 9 October 2021
Line 74:		Line 74:
	# This file should be used with pam_access in /etc/pam.d/sshd.		# This file should be used with pam_access in /etc/pam.d/sshd.
	# It grants access iff a user's IP address (rhost) is on-campus.		# It grants access iff a user's IP address (rhost) is on-campus.

	+:ALL:129.97.0.0/16 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 2620:101:f000::/47 fd74:6b6a:8eca::/47		+:ALL:129.97.0.0/16 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 2620:101:f000::/47 fd74:6b6a:8eca::/47
	-:ALL:ALL		-:ALL:ALL

Merenber: /* Helpful Links */

2021-10-09T06:08:08Z

Helpful Links

← Older revision		Revision as of 01:08, 9 October 2021
Line 83:		Line 83:
	* https://manpages.debian.org/stable/openssh-server/sshd_config.5.en.html		* https://manpages.debian.org/stable/openssh-server/sshd_config.5.en.html
	* http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html		* http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html
			* https://man7.org/linux/man-pages/man8/pam_succeed_if.8.html
			* https://linux.die.net/man/8/pam_access
	* https://cern-cert.github.io/pam_2fa/		* https://cern-cert.github.io/pam_2fa/

Merenber: /* For syscom */

2021-10-09T06:07:10Z

For syscom

← Older revision		Revision as of 01:07, 9 October 2021
Line 16:		Line 16:
	We are using the [https://duo.com/docs/duounix pam_duo] module to contact the DUO server.		We are using the [https://duo.com/docs/duounix pam_duo] module to contact the DUO server.

	=== ~~Off-campus~~ ~~case~~ ===		=== sshd config ===
	This is the relevant portion of /etc/ssh/sshd_config:		This is the relevant portion of /etc/ssh/sshd_config:
	<pre>		<pre>
Line 47:		Line 47:
	PermitRootLogin yes		PermitRootLogin yes
	</pre>		</pre>

			=== PAM config ===
	Here are is our relevant section from /etc/pam.d/sshd:		Here are is our relevant section from /etc/pam.d/sshd:
	<pre>		<pre>
Line 75:		Line 77:
	-:ALL:ALL		-:ALL:ALL
	</pre>		</pre>

	=== On-campus case ===
	In /etc/ssh/sshd_config, we also have:
	<pre>
	# On-campus
	Match Address 129.97.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,2620:101:f000::/47,fd74:6b6a:8eca::/47
	AuthenticationMethods publickey password gssapi-with-mic
	</pre>
	The IP prefixes are those for AS12093 (University of Waterloo). If someone is on-campus, then they may use just a password, or a Kerberos ticket (GSSAPI).

	== Helpful Links ==		== Helpful Links ==

Merenber: /* Off-campus case */

2021-10-09T06:06:04Z

Off-campus case

@@ Line 28: / Line 28: @@
 PubkeyAuthentication yes
 PermitEmptyPasswords no
-KerberosAuthentication yes
+KerberosAuthentication no
-# off-campus access
+# On-campus
 </pre>
 <pre>
 auth  [success=1 default=ignore] pam_duo.so
 auth  requisite pam_deny.so
 auth  required pam_permit.so
 </pre>
 === On-campus case ===

Ztseguin: Update on-campus range to include private addresses

2021-09-15T04:38:33Z

Update on-campus range to include private addresses

← Older revision		Revision as of 23:38, 14 September 2021
Line 55:		Line 55:
	<pre>		<pre>
	# On-campus		# On-campus
	Match Address 129.97.0.0/16,2620:101:f000::/47		Match Address 129.97.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,2620:101:f000::/47,fd74:6b6a:8eca::/47
	AuthenticationMethods publickey password gssapi-with-mic		AuthenticationMethods publickey password gssapi-with-mic
	</pre>		</pre>

Merenber at 03:36, 15 September 2021

2021-09-15T03:36:21Z

← Older revision		Revision as of 22:36, 14 September 2021
Line 59:		Line 59:
	</pre>		</pre>
	The IP prefixes are those for AS12093 (University of Waterloo). If someone is on-campus, then they may use just a password, or a Kerberos ticket (GSSAPI).		The IP prefixes are those for AS12093 (University of Waterloo). If someone is on-campus, then they may use just a password, or a Kerberos ticket (GSSAPI).

			== Helpful Links ==
			* https://uwaterloo.ca/information-systems-technology/services/two-factor-authentication
			* https://duo.com/docs/duounix
			* https://manpages.debian.org/stable/openssh-server/sshd_config.5.en.html
			* http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html
			* https://cern-cert.github.io/pam_2fa/

Merenber: Add syscom instructions

2021-09-15T03:34:49Z

Add syscom instructions

@@ Line 1: / Line 1: @@
-The CSC currently uses [DUO 2FA https://uwaterloo.ca/2fa] for off-campus SSH access to the general-use machines. This makes it easy to sign up new members remotely, who almost certainly already have the DUO app installed.
+The CSC currently uses [https://uwaterloo.ca/2fa DUO 2FA] for off-campus SSH access to the general-use machines. This makes it easy to sign up new members remotely, who almost certainly already have the DUO app installed.
 == For members ==
@@ Line 11: / Line 11: @@
 * public key authentication
 * password <b>and</b> DUO
-Note that you may not SSH remotely into a CSC machine using only your password.
+Note that you may not SSH remotely into a CSC machine using only your password. After you enter your password, you should see a prompt from DUO.

Merenber: Create user section

2021-09-15T03:15:31Z

Create user section

New page

The CSC currently uses [DUO 2FA https://uwaterloo.ca/2fa] for off-campus SSH access to the general-use machines. This makes it easy to sign up new members remotely, who almost certainly already have the DUO app installed.

== For members ==
If you are on campus, you may SSH into any general-use machine via:
* public key authentication
* password
* GSSAPI (Kerberos ticket)
If you are using a student CS machine as a jump host, or are using the campus VPN, this also counts as being on campus.
<br><br>
If you are off campus, you may SSH into any general-use machine via:
* public key authentication
* password <b>and</b> DUO
Note that you may not SSH remotely into a CSC machine using only your password.