SSH + Google Authenticator 安全加固

[root@clsn.io /root] clsn.io Blog WebSite
#cat  /etc/redhat-release 
CentOS release 6.8 (Final)

[root@clsn.io /root] clsn.io Blog WebSite
#uname -a
Linux clsn.io 4.10.5-1.el6.elrepo.x86_64 #1 SMP Wed Mar 22 14:55:33 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux

[root@clsn.io /root] clsn.io Blog WebSite
#sestatus 
SELinux status:                 disabled

yum -y install wget gcc make pam-devel libpng-devel

# 可在google的github下载
wget  https://github.com/google/google-authenticator/archive/1.02.tar.gz 
tar xf 1.02.tar.gz
cd google-authenticator-1.02/libpam/
./bootstrap.sh
./configure 
make && make install

# cp  /usr/local/lib/security/pam_google_authenticator.so /lib64/security/

[root@clsn.io /lib64/security] clsn.io Blog WebSite
#google-authenticator 
Do you want authentication tokens to be time-based (y/n) n
# 是否基于时间的认证，为了防止不同跨时区的问题，这里选择n
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://hotp/root@clsn.io%3Fsecret%3*****%26issuer%3Dclsn.io
# s生成的二维码
Your new secret key is: ****
Your verification code is 5****0
Your emergency scratch codes are:
  40****84
  19****95
  60****78
  83****92
  31****58
# 这5个码用于在取不到或错的验证码有错时，用于应急用的。不过每个只能用一次，不能重复使用。

Do you want me to update your "/root/.google_authenticator" file? (y/n) y

By default, three tokens are valid at any one time.  This accounts for
generated-but-not-used tokens and failed login attempts. In order to
decrease the likelihood of synchronization problems, this window can be
increased from its default size of 3 to 17. Do you want to do so (y/n) y

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y

# vim  /etc/pam.d/sshd
auth       required     pam_google_authenticator.so
------------------------------------------------------------------
#cat  /etc/pam.d/sshd 
#%PAM-1.0
auth       required pam_sepermit.so
auth       required     pam_google_authenticator.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth

# vim /etc/ssh/sshd_config
ChallengeResponseAuthentication no
#把上面配置改成

# service sshd restart 

import hmac, base64, struct, hashlib, time

def calGoogleCode(secretKey):
    input = int(time.time())//30
    key = base64.b32decode(secretKey)
    msg = struct.pack(">Q", input)
    googleCode = hmac.new(key, msg, hashlib.sha1).digest()
    o = ord(googleCode[19]) & 15
    googleCode = str((struct.unpack(">I", googleCode[o:o+4])[0] & 0x7fffffff) % 1000000)
    if len(googleCode) == 5:
        googleCode = '0' + googleCode
    return googleCode

secretKey = '***这里填秘钥***'
print calGoogleCode(secretKey)