[draft] CentOS 7에서 Google OTP를 설치하고 설정하는 방법

CentOS 7에서 Google OTP(Google Authenticator)를 설치하고 설정하는 방법

Google Authenticator는 이중 인증(2FA)을 위한 OTP(일회용 비밀번호) 솔루션입니다.

1. Google Authenticator 패키지 설치

sudo yum install -y google-authenticator

2. Google Authenticator 설정

Google Authenticator 인증 파일 생성(QR Code 생성)

google-authenticator -s ~/.ssh/google_authenticator

Do you want me to update your "/home/ec2-user/.ssh/google_authenticator" file? (y/n) y

Google_Authenticator

Do you want me to update your "/home/ec2-user/.ssh/google_authenticator" file? (y/n) y

 

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

 

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) n

 

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y

728x90

3. PAM 모듈 구성

PAM 모듈을 구성하여 SSH 또는 다른 서비스에서 Google OTP를 사용하도록 설정합니다.

PAM 설정 파일 수정

• "auth required pam_google_authenticator.so" 추가

sudo vim /etc/pam.d/sshd

#%PAM-1.0
auth       required     pam_sepermit.so
#auth       substack     password-auth
auth       include      postlogin
### Google Authenticator(Google OTP) ###
auth       required     pam_google_authenticator.so secret=/home/${USER}/.ssh/google_authenticator nullok
...

SSH 설정 파일 수정

• "ChallengeResponseAuthentication yes" 추가

sudo vim /etc/ssh/sshd_config

...
PermitEmptyPasswords no
PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods publickey,password publickey,keyboard-interactive

SSHD 데몬(서비스) 재기동

sudo systemctl restart sshd

4. SecureCRT 설정

• Connection > SSH2 > Authentication
  • Keyboard Interactive
  • PublicKey

SecureCRT_SSH

4. 테스트

SecureCRT SSH 접속

• SSH로 로그인 시 Google Authenticator의 OTP를 입력하라는 메시지가 나타나야 합니다.

SecureCRT_SSH

OTP 코드 입력

• 정상적으로 OTP를 입력하면 로그인할 수 있습니다.

CentOS 7에서 Google OTP 설정이 완료되었습니다.