Ssh
SSH - 只需要來自外部本地網路的 google-authenticator
執行 debian 變體 (osmc)
我正在嘗試做的事情：
- 通過密碼禁用 ssh，需要密鑰和Google驗證器；這一切都在工作
- 但是現在我試圖只要求來自外部本地網路的 2 因素身份驗證（備份腳本更容易，但如果有另一種更好的方法來做到這一點，請說）
目前使用 Windows 框中的 putty & pageant 進行測試，以防萬一
所以我在這裡使用解決方案 - https://serverfault.com/questions/799657/ssh-google-authenticator-ignore-whitelist-ips
現在發生了什麼 - 當我從網路外部連接時，它仍然需要根據需要進行 2 因素身份驗證從網路內部，它看起來像是辨識密鑰，但隨後出現“需要進一步身份驗證”的錯誤。
非常感謝您的幫助
sudo systemctl status ssh
Aug 25 19:51:36 mosmc sshd[10528]: error: PAM: Permission denied for osmc from beast Aug 25 19:51:36 mosmc sshd[10528]: Failed keyboard-interactive/pam for osmc from 192.168.21.3 port 54330 ssh2 Aug 25 19:51:36 mosmc sshd[10528]: error: Received disconnect from 192.168.21.3: 14: No supported authentication methods available [preauth]下面的文件貓（它提到了一個腳本，我剛剛編寫了這個媒體盒的安裝腳本，因為我的混亂一直在破壞它）
osmc@mosmc:~$ cat /etc/ssh/sshd_config # Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port XXXXXXX #changed by sshinstall # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 # Inserted hostkeys by ssh-install script HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com #End of inserted code #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 1024 # Logging SyslogFacility AUTH LogLevel VERBOSE #edited by script # Inserted ftp by ssh-install script # Log sftp level file access (read/write/etc.) that would not be easily logged otherwise. Subsystem internal-sftp /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO #End of inserted code # Authentication: LoginGraceTime 120 PermitRootLogin no #edited by script StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication yes #edited by script # Change to no to disable tunnelled clear text passwords PasswordAuthentication no #edited by script # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of PermitRootLogin without-password # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. # Inserted google-auth settings by ssh-install script AuthenticationMethods publickey,keyboard-interactive:pam KbdInteractiveAuthentication yes # Ensure /bin/login is not used so that it cannot bypass PAM settings for sshd. UseLogin no #End of inserted code UsePAM yes訪問-local.conf
osmc@mosmc:~$ cat /etc/security/access-local.conf # only allow from local IP range + : ALL : 192.168.21.0/24 + : ALL : LOCAL - : ALL : ALLpam.d
osmc@mosmc:~$ cat /etc/pam.d/sshd # PAM configuration for the Secure Shell service # Inserted PAM settings by ssh-install script auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf auth required pam_google_authenticator.so #End of inserted code # Standard Un*x authentication. #@include common-auth #commented out by sshinstall # Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so # Uncomment and edit /etc/security/access.conf if you need to set complex # access limits that are hard to express in sshd_config. # account required pam_access.so # Standard Un*x authorization. @include common-account # SELinux needs to be the first session rule. This ensures that any # lingering context has been cleared. Without this it is possible that a # module could execute code in the wrong domain. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close # Set the loginuid process attribute. session required pam_loginuid.so # Create a new session keyring. session optional pam_keyinit.so force revoke # Standard Un*x session setup and teardown. @include common-session # Print the message of the day upon successful login. # This includes a dynamically generated part from /run/motd.dynamic # and a static (admin-editable) part from /etc/motd. session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate # Print the status of the user's mailbox upon successful login. session optional pam_mail.so standard noenv # [1] # Set up user limits from /etc/security/limits.conf. session required pam_limits.so # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. session required pam_env.so user_readenv=1 envfile=/etc/default/locale # SELinux needs to intervene at login time to ensure that the process starts # in the proper default security context. Only sessions which are intended # to run in the user's context should be run after this. session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open # Standard Un*x password updating. @include common-password
auth [success=done default=ignore] pam_access.so accessfile=/etc/security/access-local.conf似乎是答案。在我了解更多資訊時對其進行編輯。
來自http://linux-pam.org/Linux-PAM-html/sag-configuration-file.html
成功=完成
done 等價於 ok ，具有終止模組堆棧和 PAM 立即返回應用程序的副作用。
預設=忽略
與一堆模組一起使用時忽略，模組的返回狀態不會影響應用程序獲得的返回碼。
來自 - https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files#134488
success=1 跳過一行。
如果其他人想寫一個更好的答案來解釋正在發生的事情 - 我很樂意接受。
感謝 Hostfission 指出我正確的部分。