MFA (Multi-Factor Authentication) Lab

Overview:

In this lab activity you will implement multi-factor authentication for the SSH service on an Ubuntu server. This will work in conjunction with the Google Authenticator app.

Remember that multi-factor authentication requires two or more means of authentication. In this activity the two factors will be something you know (a password) and something you have (the Google Authenticator token)

If you have a mobile device you can install the GoogleAuthenticator app for free. Just search the appstore or Google play for Google Authenticator.

Alternatively, if you dont have a mobile device, you can use the Chrome browser plugin for Google Authenticator.

Google Authenticator provides a OneTime Password that is Time Synchronized and must be entered at login. A random string of 6 digits will display for about 30 seconds before changing to the next sequence of 6 digits. During login, and after the users password has been entered, a prompt for the code will appear. The user will need to enter the correct 6 digit code from Google Authenticator to complete the login process.

Getting Started:

There are two pieces to this labs infrastructure.

First is an Ubuntu Linux server that will be configured to require MFA for ssh logins. (Not all login accounts will be configured to requires MFA)

Second is the GoogleAuthenticator code generating tool. This is an application that runs on a mobile device or within a web browser add-in, displaying a unique code to be entered during login. The code updates automatically every 30 seconds.

The server can be provisioned multiple ways: (choose only 1)

1. A standalone virtual machine on your laptop/desktop
2. A docker based Ubuntu container accessed via testout.dtcc.edu
3. A codeanywhere container

A virtual machine template file is available from link to ova This machine is configured with an account named student with password student

To use the docker Ubuntu container. Login to and follow the instructions below for starting up a container.

Docker Container on

1. Create an ubuntu container to use for this experiment. Initiate with the following command:
2. $docker run -h mfalab -it ubuntu:frankbuntu
3. Install the pam module that will support MFA with the following command:
4. $sudo apt-get install libpam-google-authenticator
5. Because were going to enable MFA on an account other than root, well need to first create that account
6. Add an account to be used ( useradd -m franko) and set the password for that account
7. The ubuntu container doesnt have the ssh service installed. Install it with the following command:
8. $apt-get update; apt-get install ssh (this ubuntu container requires an update first)
9. When this completes, start the ssh service with the command:
10. $service ssh start
11. Test your ability to login via ssh with the command below:
12. $ssh localhost -l franko
13. Notice you were only prompted for a single factor (password)
14. Now configure your mobile device by installing the google authenticator app
15. Configure a profile in the app by running google-authenticator and following the instructions to configure your account for MFA
16. Login to your container as that new account ($login franko)
17. To begin the setup of MFA for the franko account, run the command ($google-authenticator)
18. You should be prompted with the question Do you want authentication tokens to be time-based answer y to this. (provide guidance for the other questions)
19. Next we need to configure the ssh daemon to require MFA for accounts that are setup to use it. This is accomplished via both the sshd_config and a pam configuration file for google_authenticator.
20. Edit the file /etc/sshd_config changing the setting of ChallengeResponseAuthentication to yes
21. Because you have changed the sshd_config, youll need to restart the service with the following command:
22. $service ssh restart
23. You will also need to modify the PAM settings to enable ssh to use the google-authenticator library. In the file /etc/pam.d/ssh add the following line to the end of the file auth required pam_google_authenticator.so nullok
24. Try to login again via ssh, you should see a prompt for a verification code after you enter the password. Its working!
25. If you have trouble, make sure the clock on your server is set to the correct time. The token is based on the current time and if the clocks between your server and the google-authenticator app are not in sync, the codes will be forever incompatible.
26. If you are already using google-authenticator and have profiles in your app, make sure you are using the correct profile when you enter the code.

Standalone Server Instructions

Create an instance of an Ubuntu server virtual machine

Make sure the VM has internet access and test login to the machine via ssh (this will confirm single factor access to the machine.