Google-authenticator-libpam Alternatives

google-authenticator-libpam reviews and mentions

• Support HTTP over Unix domain sockets
  7 projects | news.ycombinator.com | 27 Nov 2023

  Especially that nowadays password authentication may fade away soon.

  Windows already supports password-less authentication quite well. It's just a matter of time until there are good solutions for Linux too.

  I have already some systems set up in a way that they ask for a TOTP when doing username/password login via SSH: https://github.com/google/google-authenticator-libpam

• Tailscale and configuring additional Google Workspace two-factor authentication for SSH connections
  1 project | /r/Tailscale | 28 Aug 2023

  We also found out that Tailscale SSH, unlike e.g Cloudflare Zero, does not seem to work with google-authenticator PAM module which could be a workaround. Please correct me if I am wrong here.

• YubiKey to secure an Ubuntu server
  1 project | /r/HomeServer | 21 Feb 2023

  (Don't worry it has nothing really to do with Google other than the fact that they wrote and open sourced the 2FA library: https://github.com/google/google-authenticator-libpam ) All logic is done locally on the server you install the pam module on, it generates a QR which you can scan and then stores the secret information in a config file in your user profile.

• Wag: An awesome self-hosted Wireguard 2FA solution
  4 projects | /r/selfhosted | 17 Nov 2022

  Out of the box, this is arguably less secure than most other remote access solutions. With OpenVPN, as well as the certificate's private key, you would usually require user credentials or a TOTP. With SSH, usually you would password-encrypt your key file, and there is the popular Google Authenticator 2FA PAM module to add TOTP support.

• Using your SIM card for MFA when logging in to an SSH server
  2 projects | news.ycombinator.com | 15 Aug 2022

  Using your SIM card for MFA when logging in to an SSH server (through paid API requests to a third party)

  There are ways to use your phone's secure storage capabilities for key storage. I've dabbled with using Krypt.co [1] for this, though that's sadly been deprecated and will at some point be replaced by a paid-for cloud service from Akamai. I'm sure there are other options available as well.

  A far superior method for SSH security would be a physical U2F key or even a smart card. It's also possible to set up TOTP as a second factor ([2], works with any TOTP solution, not just Google Authenticator). I don't see a need for this paid-for third party service unless you're already using their services for some kind of verification mechanism.

  [1]: https://krypt.co/

  [2]: https://github.com/google/google-authenticator-libpam

• SSH Key Passphrase
  2 projects | /r/sysadmin | 31 Jul 2022

  dont think you can since the passphrase is client side. you could require mfa on top of the login via sshkey. eg. https://github.com/google/google-authenticator-libpam

• Configure PAM to use Google Authenticator / TOTP instead of password authentication
  1 project | /r/linuxmasterrace | 24 Dec 2021

  Have a look at https://github.com/google/google-authenticator-libpam

• How to SSH Properly
  1 project | dev.to | 15 Dec 2021

  The google-authenticator module has many options you can set which are documented here. In the interest of saving time, we are going to use some sane defaults in this example: disallow reuse of the same token twice, issue time-based rather than counter-based codes, and limit the user to a maximum of three logins every 30 seconds. To set up Google 2-factor authentication with these settings, a user should run this command:

• Looking for reliable open-source 2FA self hosted server
  4 projects | /r/sysadmin | 18 Nov 2021

  Install Active Directory servers, one for each site. Both need to be DNS servers and Global Catalogs.Add users to be authenticated as normal, the users PIN will be their domain password.(You can skip the above), just use your existing users.Install Centos 7 Use static IP address(es) and point the DNS to the domain controller(s) Configure the hostname and FQDN to an appropriate value. Note this will be visible in Google Authenticator.Patch the OS yum -y updateStop and disble SELinux and the firewall systemctl stop firewalld.service systemctl disable firewalld.service vi /etc/selinux/config Change SELINUX=enforcing to SELINUX=disabled Save and exit then reboot.Install and configure FreeRADIUS yum -y install freeradius freeradius-utils vi /etc/raddb/radiusd.conf Change #user = radiusd to user = root Change #group = radiusd to group = root vi /etc/raddb/sites-enabled/default Change # pam to pam ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam vi /etc/raddb/clients.conf - The client IP and/or subnet need to match where the requests are coming from Add to the end client 192.168.0.0 { ipaddr = 192.168.0.0/24 secret = password - Whatever secret you configure here must match where the requests are coming from require_message_authenticator = no nas_type = other } vi /etc/raddb/users Change #DEFAULT Group == "disabled",Auth-Type:=Reject # Reply-Message = "Your account has been disabled." to DEFAULT Group == "disabled",Auth-Type:=Reject Reply-Message = "Your account has been disabled." DEFAULT Auth-Type := PAMInstall and configure SSSD yum -y install sssd realmd adcli yum -y install oddjob oddjob-mkhomedir sssd samba-common-tools realm join gatest.local - This is the domain name that holds the accounts for Google Authenticator vi /etc/sssd/sssd.conf Change use_fully_qualified_name = True to use_fully_qualified_name = False chmod 400 /etc/sssd/sssd.confInstall and configure Google Authenticator yum -y install pam-devel make gcc-c++ git yum -y install automake autoconf libtool cd ~ git clone https://github.com/google/google-authenticator-libpam.git cd ~/google-authenticator-libpam/ ./bootstrap.sh ./configure make make installConfigure PAM vi /etc/pam.d/radiusd Comment out the existing entries and then add the following at the end auth requisite /usr/local/lib/security/pam_google_authenticator.so forward_pass auth required pam_sss.so use_first_pass account required pam_nologin.so account include password-auth session include password-authEnable FreeRADIUS Service systemctl enable radiusd systemctl start radiusdInstall google authenticator yum install google-authenticatorSetup Google Authenticator for a user su - username - This is the user account created in Active Directory cd ~ - Make certain you're now in their /home/username directory google-authenticator - Answer the following questions with Y, Y (take a screenshot of the QR code), -1, Y, N, Y The user should now be able to authenticate using their domain name as the account name, their domain password as their PIN and their token code.

• Linux terminal noob zoom question
  1 project | /r/linuxquestions | 12 Sep 2021

  For QR codes in particular, pam_google_authenticator does this.

• A note from our sponsor - InfluxDB
  www.influxdata.com | 2 May 2024

  Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality. Learn more →