Two Factor Authentication for SSH (with Google Authenticator)

Two factor authentication is a method of ensuring that a user has a physical device in addition to their password when logging in to some service. This works by using a time (or counter) based code which is generated by the device and checked by the host machine. Google provides a service which allows one to use their phone as the physical device using a simple app.

This service can be easily configured and greatly increases the security of your host.

Installing Dependencies

1. There is only one: the Google-Authenticator software itself:

   # pkg install pam_google_authenticator

On older FreeBSD intallations you may use:

# pkg_add -r pam_google_authenticator

On Debian derived systems use:

# apt-get install libpam-google-authenticator

User configuration

Each user must run "google-authenticator" once prior to being able to login with ssh. This will be followed by a series of yes/no prompts which are fairly self-explanatory. Note that the alternate to time-based is to use a counter. It is easy to lose track of which number you are at so most people prefer time-based.

2. $ google-authenticator
   Do you want authentication tokens to be time-based (y/n)
   ...
   

   Make sure to save the URL or secret key generated here as it will be required later.

Host Configuration

To enable use of Authenticator the host must be set up to use PAM which must be configured to prompt for Authenticator.

3. Edit the file /etc/pam.d/sshd and add the following in the "auth" section prior to pam_unix:

   auth requisite pam_google_authenticator.so

4. Edit /etc/ssh/sshd_config and uncomment

   ChallengeResponseAuthentication yes

Reload ssh config

5. Finally, the ssh server needs to reload its configuration:

   # service sshd reload

Configure the device

6. Follow the instructions provided by Google to install the authentication app and setup the phone.

That is it. Try logging into your machine from a remote machine now

Thanks bcallah for proof-reading this post.

NFS Mount Network Booting VirtualBox

In order to test modifications to the FreeBSD kernel, I would like to boot a diskless virtual machine. The goal is to be able to quickly test changed I make without needing to recreate the VM each time, or run the installation procedure inside of the VM.

You can elect to put the root anywhere you want. For this example, I will be using /home/vm as the root of the virtual machine.

There are a few aspects to this:

• The filesystem that will be booted.
• VirtualBox setup
• Virtual machine setup
• DHCP server
• Host setup

Filesystem Installation

1. Create the distribution:

   cd /usr/src 
   make installworld installkernel distribution DESTDIR=/home/vm
   

2. Create the /conf directory used for diskless boot. See /etc/rc.initdiskless for details.
   

   # cd /home/vm/
   # mkdir -p conf/base/etc
   # cd conf/base/etc
   # cat diskless_remount 
   /etc
   # cat fstab 
   md    /tmp    mfs    -s=30m,rw    0 0
   md    /var    mfs    -s=30m,rw    0 0
   # cat md_size 
   256m
   

VirtualBox Setup

Create a "host-only" interface with DHCP disabled. To do this:

1. Open up the preferences screen and go the "network" tab.
   
2. Create a new host-only network (the green plus on the right).
   
3. Disable the DHCP Server.
   
4. Select an IP Address in the range your VM will have.
   
5. Note that the DHCP server will continue to run until killed or the machine rebooted:

   ## Note that you may kill too much here. Be careful.
   # pgrep -fl DHCP
   # pkill -15 DHCP
   

Create the Virtual Machine

1. Create a new virtual machine. Make sure to select "FreeBSD - 64 bit". Note that you should create this machine without any disk (and ignore the warning at the end).
   
2. Open up the virtual machine's settings
   
3. Select only the "Network" option under boot order (System->Motherboard->Boot Order). Also check "Hardware clock in UTC time."
   
4. Under network select the Host Only Adapter created before. Under advanced options, change the adapter type to "PCNet-PCI II." Also make a note of the mac address of the virtual machine. It will be needed later.
   

DHCP Server

For simplicity I opted to use a really simple DHCP server dnsmasq:

1. Install dnsmasq
   

   $ make -C /usr/ports/dns/dnsmasq install clean
   

2. Configure dnsmasq to server as a tftp and DHCP server for the virtual machine interface. Modify /usr/local/etc/dnsmasq.conf (I've bolded the parts that are configuration specific):
   

   interface=vboxnet0
   dhcp-range=172.16.100.100,172.16.100.200,48h[1]
   #Note that this mac address is the mac address of the vm noted earlier.
   dhcp-host=01:02:03:04:05:06,vm-testing,172.16.100.100,set:diskless
   dhcp-boot=tag:diskless,/home/vm/boot/pxeboot
   dhcp-option=tag:diskless,option:root-path,"/home/vm/"
   enable-tftp
   

3. Add this to /etc/dhclient.conf so that you can reference your virtual machine by name:
   

   precede domain-name-servers 127.0.0.1;
   

Host Setup

1. Add the following to /etc/rc.conf:

   # Required for VirtualBox
   devfs_system_ruleset="system" 
   
   # Required for diskless boot
   dnsmasq_enable="YES"
   
   # NFS Exports
   rpcbind_enable="YES"
   nfs_server_enable="YES"
   mountd_enable="YES"
   mountd_flags="-r"
   nfs_client_enable="YES"
   weak_mountd_authentication="YES"
   

2. Add the directory to /etc/exports:

   /home/vm -ro -alldirs -network 172.16.0.0 -maproot=root
   

Now you are all set. Just boot the virtual machine from VirtualBox and watch it go!

---

1. Note that the 172.16.0.0/20 network is RFC 1918 private address space.