OpenSSH Two Factor Authentication (But Not Service Accounts)

david@systemoverlord.com (David Tomaschik) — Sat, 03 Mar 2018 00:00:00 +0000

Very often, people hear “SSH” and “two factor authentication” and assume you’re talking about an SSH keypair that’s got the private key protected with a passphrase. And while this is a reasonable approximation of a two factor system, it’s not actually two factor authentication because the server is not using two separate factors to authenticate the user. The only factor is the SSH keypair, and there’s no way for the server to know if that key was protected with a passphrase. However, OpenSSH has supported true two factor authentication for nearly 5 years now, so it’s quite possible to build even more robust security.

OpenSSH on System Overlord

OpenSSH Two Factor Authentication (But Not Service Accounts)