Linux 安装Google AuthenticatorSSH登陆二次验证

提示：教程需要配合Google身份验证器一起使用，手机没有安装该APP的需要安装一下，方便获取动态验证码。

#CentOS 6系统
rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
yum install google-authenticator -y

#CentOS 7系统
rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum install google-authenticator -y

#Debian/Ubuntu系统
apt update
apt install libpam-google-authenticator -y

#CentOS系统
yum install gcc make pam-devel libpng-devel libtool wget git autoconf automake qrencode -y

#Debian/Ubuntu系统
apt update
apt install -y gcc make autoconf automake libtool libpam0g-dev libqrencode3 git

git clone https://github.com/google/google-authenticator-libpam.git
cd google-authenticator-libpam
./bootstrap.sh
./configure
make && make install

google-authenticator

Do you want authentication tokens to be time-based (y/n) y
#验证二维码，在浏览器打开使用谷歌验证器APP扫描添加即可。
https://www.google.com/chart?chs=200x200xxx
Your new secret key is: WKDPJHOKR2P3DOWL
Your verification code is 189192
#临时验证码，手机不在身边可以使用，不过一个码只能用一次
Your emergency scratch codes are:
  77678926
  14729443
  83656478
  55669982
  23960253

#下面可以直接照着填，或者自己使用谷歌翻译，然后自行选择
Do you want me to update your "/root/.google_authenticator" file (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y

nano /etc/pam.d/sshd

#CentOS 6在#%PAM-1.0下面一行添加
#CentOS 7在auth substack password-auth下面一行添加
#Debian和Ubuntu在末尾添加

#CentOS 6系统
sed -i '1a\auth required pam_google_authenticator.so' /etc/pam.d/sshd
#CentOS 7系统
sed -i "/auth[ ]*substack[ ]*pass*/a\auth required pam_google_authenticator.so" /etc/pam.d/sshd
#Debian/Ubuntu系统
echo 'auth required pam_google_authenticator.so' >>/etc/pam.d/sshd

#CentOS系统
ln -fs /usr/local/lib/security/pam_google_authenticator.so /lib64/security/
#Debian/Ubuntu系统
ln -fs /usr/local/lib/security/pam_google_authenticator.so /lib/x86_64-linux-gnu/security/

sed -i -r 's#(ChallengeResponseAuthentication) no#\1 yes#g' /etc/ssh/sshd_config

#查看下服务器时间
date
#如果时区不一样，再使用命令修改为本地时间
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

#使用命令查看状态
getenforce
#如果输出disabled则为关闭，反之开启，然后使用命令关闭
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

#CentOS系统
service sshd restart
#Debian/Ubuntu系统
service ssh restart