Scripting one time ssh access to allow for Google Authenticator setup

Linux

Scripting one time ssh access to allow for Google Authenticator setup

by nschoonover December 30, 2016

In our previous article we setup google-authenticator for authenticating openssh. Now, we need a way for users to be able to login once before setting up google-authenticator. Here is a script for checking if a user has not logged in and ran google-authentication yet, runs google-authenticator, then prevents that user from logging in again without either google-authentication or an ssh public key. To setup this script do the following:

Edit /etc/pam.d/sshd and make the following changes after #%PAM-1.0
```
auth    required        pam_sss.so try_first_pass
auth    sufficient  pam_listfile.so item=user sense=allow file=/google-auth/authusers
auth    sufficient      pam_google_authenticator.so
auth       required     pam_sepermit.so
#auth       include      password-auth
```
We are using ldap, so our users authenticate with pam_sss.so. If you are using regular unix passwords, you should change this first required auth line to pam_unix.so instead. We setup a pam_listfile, which has a list of all the users we want to allow access to login. Our script, called from each of these users .bash_profile file, will remove the user from this file after their first login without google-authenticator setup. Notice, we commented out the password-auth include line. We do not want to call the password-auth file because we only want users to be able to log in if they are in if they can first authenticate with sss/ldad and are in our google-auth list. Otherwise, they can login with google_authenticator, or from an sshd key, which will happen before the authentication is sent to pam.
Create the /google-auth/authusers file, which pam will check for which users to allow without requiring further authentication. I used /home/ to see which users are actual human users who will need to login. This file just needs to be a list with one username per line. This file needs to be in a new directory, because we need to give all of these users permission to write to it so their usernames can be removed via our script once they create a google authentication file.

a. create a group and add all of the necesarry users to this group.
```
groupadd google-auth
gpasswd google-auth -M bob,joe,smith
```
b. Now create the authusers file and set the permissions to be owned by google-auth, then allowed write access by users in that group.
```
mkdir /google-auth/
touch /google-auth/authusers
chgrp google-auth /google-auth/authusers
chmod ug=rwx,o= /google-auth/authusers
```
c. Now add the necesarry users to /google-auth/authusers
```
bob
joe
smith
```
Install the script to be ran. Just add these couple lines to an .sh file in /usr/local/bin, or you can copy it over if you did a git pull. I created my script with vim /usr/local/bin/google-auth-check.sh
```
#!/bin/bash

if [ ! -f ~/.google_authenticator ]; then
    google-authenticator
    if [ -f ~/.google_authenticator ]; then
        sed -i "/^${USER}$/d" /google-auth/authusers
    fi
fi
```
And then give it execute permissions.
```
chmod +x /usr/local/bin/google-auth-check.sh
```
Next, we need to add this script to each of the ~/.bash\_profile files in each users home directory. I will come up with a find and echo command, but for now, just add this at the end of these files in each users directory you want this to work for.
```
sh /usr/local/bin/google-auth-check.sh
```

You can run this bash command to find every .bash_profile in /home/ and append the line above. Be careful before running this command. It works on my system, but you can never be too careful with recursive commands such as this.

find /home/ -name ".bash_profile" -print0 | xargs --verbose -0 -I{} sh -c "echo 'sh /usr/local/bin/google-auth-check.sh' >> {}"

This should be all you need to do. Now when a user logs in for the first time, the google-authenticator application will automatically run and create a .google\_authenticator file. The user will then be able to add the key into their phone app and have multifactor authentication to log into their account. Their name will get removed from the /google-auth/authusers file, so they will no longer be given access without a multi factor auth, or ssh key.

Sources:

https://www.digitalocean.com/community/tutorials/how-to-use-pam-to-configure-authentication-on-an-ubuntu-12-04-vps

http://www.linux-pam.org/Linux-PAM-html/sag-pam_exec.html

https://wiki.archlinux.org/index.php/PAM