diff options
| author | Christian Poessinger <christian@poessinger.com> | 2022-10-12 09:02:37 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-10-12 09:02:37 +0200 |
| commit | 6951fa7ef6ea4a2715b9083d654f6cf3f3b60213 (patch) | |
| tree | 694540848ff0a3ef4fa1ede3659f68bb459c1787 /data | |
| parent | b74f297d8a7426cbdb0b44240bfa4b7666986337 (diff) | |
| parent | 765f84386b6e94984ff79db2eab36d51f759159b (diff) | |
| download | vyos-1x-6951fa7ef6ea4a2715b9083d654f6cf3f3b60213.tar.gz vyos-1x-6951fa7ef6ea4a2715b9083d654f6cf3f3b60213.zip | |
Merge pull request #1555 from goodNETnick/ssh_otp
system login: T874: add 2FA support for local and ssh authentication
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/login/pam_otp_ga.conf.j2 | 7 | ||||
| -rw-r--r-- | data/templates/ssh/sshd_config.j2 | 4 |
2 files changed, 9 insertions, 2 deletions
diff --git a/data/templates/login/pam_otp_ga.conf.j2 b/data/templates/login/pam_otp_ga.conf.j2 new file mode 100644 index 000000000..4c1f411d1 --- /dev/null +++ b/data/templates/login/pam_otp_ga.conf.j2 @@ -0,0 +1,7 @@ +{% if authentication.otp.key is vyos_defined %} +{{ authentication.otp.key }} +" RATE_LIMIT {{ authentication.otp.rate_limit }} {{ authentication.otp.rate_time }} +" WINDOW_SIZE {{ authentication.otp.window_size }} +" DISALLOW_REUSE +" TOTP_AUTH +{% endif %} diff --git a/data/templates/ssh/sshd_config.j2 b/data/templates/ssh/sshd_config.j2 index 79b07478b..5bbfdeb88 100644 --- a/data/templates/ssh/sshd_config.j2 +++ b/data/templates/ssh/sshd_config.j2 @@ -17,7 +17,6 @@ PubkeyAuthentication yes IgnoreRhosts yes HostbasedAuthentication no PermitEmptyPasswords no -ChallengeResponseAuthentication no X11Forwarding yes X11DisplayOffset 10 PrintMotd no @@ -30,6 +29,7 @@ PermitRootLogin no PidFile /run/sshd/sshd.pid AddressFamily any DebianBanner no +PasswordAuthentication no # # User configurable section @@ -48,7 +48,7 @@ Port {{ value }} LogLevel {{ loglevel | upper }} # Specifies whether password authentication is allowed -PasswordAuthentication {{ "no" if disable_password_authentication is vyos_defined else "yes" }} +ChallengeResponseAuthentication {{ "no" if disable_password_authentication is vyos_defined else "yes" }} {% if listen_address is vyos_defined %} # Specifies the local addresses sshd should listen on |