Hak5

Hosted by Darren Kitchen and Shannon Morse. New episodes Tuesdays.

Put together by a band of IT ninjas, security professionals and hardcore gamers, Hak5 isn't your typical tech show. We take on hacking in the old-school sense, covering everything from network security, open source and forensics, to DIY modding and the homebrew scene. Then we wrap it all up with a... Read More

2-Factor SSH with Google Authenticator and Challenge Response Authentication

Wednesday, June 6th, 2012 – running time 35:03

More episodes:

Download this episode:

  • MP4
  • Theora
  • WebM

We challenge you... to respond... then we'll authenticate ya! That's right, we're getting into Challenge Response Authentication. Plus Two-Factor Authentication for SSH using the Google Authenticator, and how not to lock yourself out of your own workstation. All that and more, this time on Hak5!

Challenge Response Authentication

  • Used in the 80's and 90's for copy protection (Wolfenstein SoD example)
  • DRYAD Example
    • Used for Authentication or Encryption by US military
  • Keyboard Interactive is define in an Internet-draft to the IETF two Googlers in 2004 describe "Generic Message Exchange Authentication for SSH"


Example of Lame-Ass-Challenge-Response-Authentication

  • Client initiates connection to server
  • Server asks for password
  • Client tells server password
  • Server lets client connect, they become BFF
  • Eavesdropping hacker now knows password


One-way hash

  • Takes input, returns hash value
  • Finding input from hash value is "computationally infeasible"
  • Popular funcations include MD5, SHA


Example of proper Challenge-Response Authentication

  • Client initiates connection to server
  • Server "challenges" client by sending a random number
  • Client "responds" by using one-way hash to compute random number + password, sends result
  • Server uses same one-way hash to compute random number + password, verifies result
  • If result matches, client and server become BFF
  • Eavesdropping hacker now knows a random number and a the resulting hash from said random number + the password :-(


Weaknesses in CRA

  • If a challenge is used more than once, the hacker can simply replay the hash
  • Mitigated by using long random numbers


SSH 2-Factor Authentication via Google Authenticator

Ubuntu 10.04 setup based off webbynode guide.

# Install Google Authenticator PAM module
$ cd ~
$ wget http://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2
$ tar jxvf libpam-google-authenticator-1.0-source.tar.bz2
$ cd google-authenticator
$ sudo make install
# Edit /etc/ssh/sshd_config and change the ChallengeResponseAuthentication to yes
# Edit /etc/pam.d/sshd and add
# auth    required                        pam_google_authenticator.so
#*** Some guides recommend adding the above line to the /etc/pam.d/common-auth file.
#*** You'll wish you hadn't if you're testing this on your desktop with gnome/kde/etc ;-)
# Configure the user account
$ google-authenticator
# Follow the URL and scan the barcode from your phones google authenticator app
# Restart sshd:
$ /etc/init.d/ssh restart
# Login as normal and you'll be prompted for verification code in addition to password

If you're into Hak5 you'll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you're a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let's not forget to mention that you can follow us on Twitter and Facebook. Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org.

Connect with Hak5

About the Show

Details
Show Title:
Hak5
Description:
Hak5 isn't your typical tech show. It's hacking in the old-school sense, covering everything from network security, open source and forensics to DIY modding and the homebrew scene. Damn the warranties, it's time to Trust your Technolust.
Categories:
How-To & DIY, Technology & Gadgets
Launch Date:
Sep 7, 2008
Episodes:
330
Credits
Shannon Morse (Host)
Darren Kitchen (Host)