This article is about on how to secure a public or DMZ machine or stronger SFTP/SSH server by using One Time Passwords provided by the SecurePass security service.
One Time Passwords are a great solution to have a strong authentication solution that can easily be adopted by everyone and supported on every device.
This article has been originally written by Luca Perencin.
Prerequisites
The only pre-requisite is having an Ubuntu server up and running and at least one static IP address.
SecurePass
If you don’t own already an account with SecurePass, you can sign-up for a new account here: http://www.secure-pass.net/open
Note: Use “misec2011” as promo code, it will give you an entitlement for using SecurePass up to 10 users for 2 years free-of-charge.
Connect to the admin interface on https://admin.secure-pass.net and create a new device.
As showed in picture, we only need to set the public IP Address of the server, a fully qualified domain name (FQDN), and the secret password for the radius authentication.After completion we get a small recap of the already created device.
Install and Configure RADIUS
Install the radius library with the following command:
apt-get install libpam-radius-auth
At this point, we can log in to the server to configure the radius authentication. pick your favourite editor to open /etc/pam_radius_auth.conf and add, at the end of the file the following lines
radius1.secure-pass.net secret 3 radius2.secure-pass.net secret 3
Of course the “secret” is the same we have set up on the secure-pass site beyond this point we need to configure the PAM to correct manage the authentication.
Pick up again an editor and open /etc/pam.d/common-auth
we have to setup two simple lines:
auth<-->sufficient<---->pam_radius_auth.so. auth<-->[success=1 default=ignore]<---->pam_unix.so nullok_secure try_first_pass
Create a local user
Create the local user(s) that match(es) with the user in SecurePass, for example if you have jsmith@foo.bar in SecurePass, you will have to create a local jsmith
Further information
* http://www.nolabs.it/2011/12/02/eng-how-to-setup-an-easy-otp-access-on-ubuntu-with-secure-pass/