The CSC currently uses DUO 2FA for off-campus SSH access to the general-use machines. This makes it easy to sign up new members remotely, who almost certainly already have the DUO app installed.
If you are on campus, you may SSH into any general-use machine via:
- public key authentication
- GSSAPI (Kerberos ticket)
If you are using a student CS machine as a jump host, or are using the campus VPN, this also counts as being on campus.
If you are off campus, you may SSH into any general-use machine via:
- public key authentication
- password and DUO
Note that you may not SSH remotely into a CSC machine using only your password. After you enter your password, you should see a prompt from DUO.
We are using the pam_duo module to contact the DUO server.
This is the relevant portion of /etc/ssh/sshd_config:
# For pam_duo UsePAM yes # DUO should be passed the IP address, not the hostname UseDNS no # public key authentication with authorized_keys PubkeyAuthentication yes # Everyone *must* go through PAM for authentication ('keyboard-interactive'), # unless they use GSSAPI or pubkey. # Despite PasswordAuthentication being set to 'no', users may still use a # password to login via PAM. # See /etc/pam.d/sshd. PasswordAuthentication no PermitEmptyPasswords no KerberosAuthentication no ChallengeResponseAuthentication yes AuthenticationMethods publickey gssapi-with-mic keyboard-interactive # Disable root login by default (off-campus) PermitRootLogin no # On-campus # If you update the IP addresses here, make sure to also update /etc/security/pam_on_campus.conf Match Address 126.96.36.199/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,2620:101:f000::/47,fd74:6b6a:8eca::/47 PermitRootLogin yes
Here are is our relevant section from /etc/pam.d/sshd:
# Early kill switch. auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/pam_on_campus.conf auth requisite pam_succeed_if.so user != root # Standard Un*x authentication. @include common-auth # Skip DUO if the user is on campus. auth [success=2 default=ignore] pam_access.so accessfile=/etc/security/pam_on_campus.conf auth [success=1 default=ignore] pam_duo.so auth requisite pam_deny.so auth required pam_permit.so
The "early kill switch" will reject a user immediately, without even asking them for their password, if they try to login as root from off-campus. So we technically don't need the Match block in sshd_config; however, I recommend keeping it anyways, since it provides an extra layer of security (read: peace of mind).
Once we know that the user is either on-campus, or non-root and off-campus, we run through common-auth. The user must successfully pass either pam_unix or pam_krb5/pam_sss.
Finally, we check DUO iff the user is off-campus. Note that DUO will by default accept users which do not exist in ADFS, which means that local users (i.e. in /etc/passwd) can theoretically still login from off-campus with only a password. We don't want this; therefore, it is important that the only local user with a password should be root, since we already catch that case.
Here is our /etc/security/pam_on_campus.conf. See pam_access for details.
# This file should be used with pam_access in /etc/pam.d/sshd. # It grants access iff a user's IP address (rhost) is on-campus. +:ALL:188.8.131.52/16 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 2620:101:f000::/47 fd74:6b6a:8eca::/47 -:ALL:ALL
In /etc/ssh/sshd_config, we also have:
# On-campus Match Address 184.108.40.206/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,2620:101:f000::/47,fd74:6b6a:8eca::/47 AuthenticationMethods publickey password gssapi-with-mic
The IP prefixes are those for AS12093 (University of Waterloo). If someone is on-campus, then they may use just a password, or a Kerberos ticket (GSSAPI).