Skip to main content

Google Authenticator

Google Authenticator is a two-step verification software token supporting TOTP and HOTP, used for Google's authentication services. The algorithms used by this service are specified in RFC 6238 and RFC 4226.

Google Authenticator provides users with a six- to eight-digit one-time password for additional verification when logging into Google or other sites. It can also generate tokens for third-party applications, such as password managers or cloud storage services.

1. Installation and Usage​

  1. Software installation

    a. Binary installation

    yum install -y epel-* mercurial autoconf automake libtool pam-devel

    yum install -y google-authenticator

    b. Compilation installation

    yum install -y epel-* mercurial autoconf automake libtool pam-devel git 

    git clone https://github.com/google/google-authenticator-libpam.git

    cd google-authenticator-libpam-master/  # Enter the directory
    chmod +x bootstrap.sh  # Set executable permissions
    ./bootstrap.sh  
    ./configure
    make install 
    ln -s /usr/local/lib/security/pam_google_authenticator.so /usr/lib64/security/pam_google_authenticator.so

  2. PAM configuration

    vim /etc/pam.d/sshd
    auth required pam_google_authenticator.so
    # Or
    echo   "auth       required     pam_google_authenticator.so" >>/etc/pam.d/sshd

  3. SSH configuration

    vim /etc/ssh/sshd_config
    # Change
    ChallengeResponseAuthentication no
    # To
    ChallengeResponseAuthentication yes
    # Or
    sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' /etc/ssh/sshd_config
    # Restart the sshd service
    systemctl restart sshd.service

  4. google-authenticator runtime configuration

    In general, first run the google-authenticator binary program, then press 'y' throughout the process. During this, use a QR code or a secret key to bind with a mobile device. The specific process is detailed below.

    google-authenticator
    Do you want authentication tokens to be time-based (y/n) y
    Warning: pasting the following URL into your browser exposes the OTP secret to Google:
    https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@demo%3Fsecret%3DEXAMPLE_SECRET_DO_NOT_USE%26issuer%3Ddemo
                                                            
                                                                                    
                                                                                    
                                                                                    
                A QR code will appear here; you need to download the `googleauthenticator` APP on your mobile phone to scan and bind.
                Both Android and iOS phones can search and install it from the app store.
                                                                                    
                                                                                    
                                                                                                                                                                        
    Your new secret key is: EXAMPLE_SECRET_DO_NOT_USE
    Your verification code is 917990
    Your emergency scratch codes are:
    42623319
    72314571
    14476695
    95764389
    38976136

    Do you want me to update your "/root/.google_authenticator" file? (y/n) y

    Do you want to disallow multiple uses of the same authentication
    token? This restricts you to one login about every 30s, but it increases
    your chances to notice or even prevent man-in-the-middle attacks (y/n) y

    By default, a new token is generated every 30 seconds by the mobile app.
    In order to compensate for possible time-skew between the client and the server,
    we allow an extra token before and after the current time. This allows for a
    time skew of up to 30 seconds between authentication server and client. If you
    experience problems with poor time synchronization, you can increase the window
    from its default size of 3 permitted codes (one previous code, the current
    code, the next code) to 17 permitted codes (the 8 previous codes, the current
    code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
    between client and server.
    Do you want to do so? (y/n) y

    If the computer that you are logging into isn't hardened against brute-force
    login attempts, you can enable rate-limiting for the authentication module.
    By default, this limits attackers to no more than 3 login attempts every 30s.
    Do you want to enable rate-limiting? (y/n) y

  5. Login

    a. xshell