google Authenticator(谷歌身份驗證器)，是谷歌公司推出的一款動態令牌工具，解決賬戶使用時遭到的一些不安全的操作進行的“二次驗證”，認證器基于RFC文檔中的HOTP/TOTP算法實現 ，是一種從共享秘鑰和時間或次數一次性令牌的算法。在實際應用中可以通過認證器方式對賬戶有更好的保護
下面在centos7下利用Google Authenticator實現SSH登錄的二次身份驗證
1、配置EPEL源
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum makecache
2、安裝Google Authenticator
yum install google-authenticator -y
3、google-authenticator初始化配置
哪個賬號需要動態驗證碼，切換到該賬號下操作進行操作 下面創建如下一個賬戶進行操作
useradd yuanfan
passwd yuanfan
su - yuanfan
google-authenticatorYour new secret key is: G5RR2IJG2X74MI4ADW622R6PUA #如果在手機的谷歌身份驗證器上不想通過"掃描條形碼"的方式添加，就輸入這個key，通過"手動輸入驗證碼的方式"Your verification code is 906194
Your emergency scratch codes are:
#下面會生成5個緊急驗證碼(當無法獲取動態驗證碼或驗證碼不能使用時可以使用這5個)，
#需要注意的是：這5個驗證碼用一個就會少一個！請保存好！
45731126
22009120
27836115
94685459
48945214
Do you want me to update your "/home/yuanfan/.google_authenticator" file? (y/n) y #提示是否要更新驗證文件，選擇yDo you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y # 禁止使用相同口令
By default, a new token is generated every 30 seconds by the mobile App.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y #默認動態驗證碼在30秒內有效，由于客戶端和服務器可能會存在時間差，可將時間增加到最長4分鐘，是否要這么做：這里選擇y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y #是否限制嘗試次數，每30秒只能嘗試最多3次，這里選擇y進行限制
4、修改SSH登錄相關配置文件參數
如下行添加如下參數
vim /etc/pam.d/sshd (如下位置增加下面一行)
auth required pam_google_authenticator.so
vim /etc/ssh/sshd_config
將ChallengeResponseAuthentication修改為yes
ChallengeResponseAuthentication yes
service sshd restart
5、手機下載google身份驗證器
以Android/ target=_blank class=infotextkey>安卓手機為例 掃描QR碼方式來進行綁定
6、登錄驗證測試
ssh yuanfan@localhost
然后輸入手機google身份驗證器生成的動態驗證碼(每30秒更新一次)
SecureCRT登錄時，將Keyboard Interactive登錄方式調整為第一個位置
注意，如果沒有用root用戶進行第三步的操作，需要先其它用戶登錄后su root切換到root
https://wiki.archlinux.org/index.php/Google_Authenticator
