Skip to main content

Local privilege 2FA with SSH Keys

Local Privileges Account 2FA​

Local privileged accounts can have 2FA enabled, which uses an SSH key or password as the first factor and an approval push as the second factor. After the first factor succeeds, AuthNull sends a push through your organisation's MFA provider (Settings → MFA Provider: AuthNull Authenticator, Duo Security or Okta Verify). When it is approved, the user is logged in to the endpoint; when it is denied or not answered, the login is refused.

For AuthNull Authenticator, each person who logs in needs a registered phone: Users → row ⋯ → Register device.

This page covers SSH keys as the first factor. For passwords, see Configure Local 2FA with Passwords.

tip

If the endpoint is reached through an AuthNull gateway, you do not need a PAM module on the endpoint: the gateway asks for the push and records the session. See How to Set Up a Gateway and Connect.

Configuring Local Privileged Account for Logging via SSH Keys​

Generating Keys for SSH Login​

  1. Use the command:

    ssh-keygen

  2. To transfer keys, use the command below:

    cat ~/.ssh/id_rsa.pub | ssh username@ipaddress "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Configuring the AuthNull PAM Module for SSH Login​

  1. Install the AuthNull agent and the AuthNull PAM module on the endpoint as described in Agent based MFA for Linux (Part 1 and Part 2). The module's configure script updates the SSH and PAM settings.

  2. For SSH Key authentication, make sure the lines below are at the end of the sshd_config file, so that the key is required first and the push second. Path: /etc/ssh/sshd_config

    AuthenticationMethods publickey,keyboard-interactive
    KbdInteractiveAuthentication yes

  3. Restart the SSH service:

    sudo systemctl restart sshd

  4. Now log in to the VM using SSH:

    ssh username@ipaddress

    a. Enter the passphrase for the private key (make sure the public key is placed inside the $HOME/.ssh/authorized_keys path).

    b. The second factor starts: approve the push on your phone. Check the logs from /var/log/auth.log (for Ubuntu-based systems) or /var/log/secure (for CentOS-based systems).

  5. The following are issues you may encounter while building the PAM module:

    a. PAM (header) not found

    • On CentOS and RHEL VMs, install the pam-devel package:

      sudo yum install pam-devel

    • On Debian/Ubuntu VMs, install libpam0g-dev:

      sudo apt-get install libpam0g-dev

    b. Autoconf not installed/found

    sudo apt-get install autoconf automake gdb git libffi-dev zlib1g-dev libssl-dev

    (For Debian/Ubuntu)

Note: To exclude a user group from AuthNull's PAM authentication, configure the following in /etc/pam.d/sshd before the AuthNull line (this will exclude users in the group {group_name} from MFA):

auth [success=done default=ignore] pam_succeed_if.so user ingroup group_name

To keep an emergency account that logs in with an SSH key only, see Break Glass Account in SSH.