Created
May 28, 2017 13:00
-
-
Save davidporter-id-au/0eb7b871800e6edb466c372e2f55f766 to your computer and use it in GitHub Desktop.
mfa on ubuntu 16 for users allowed to use password-based auth
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| account required pam_nologin.so | |
| @include common-account | |
| session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close | |
| session required pam_loginuid.so | |
| session optional pam_keyinit.so force revoke | |
| @include common-session | |
| session optional pam_motd.so motd=/run/motd.dynamic | |
| session optional pam_motd.so noupdate | |
| session required pam_limits.so | |
| session required pam_env.so user_readenv=1 envfile=/etc/default/locale | |
| session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open | |
| @include common-password | |
| auth required pam_unix.so try_first_pass | |
| auth required pam_google_authenticator.so |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Port 22 | |
| port 443 | |
| Protocol 2 | |
| HostKey /etc/ssh/ssh_host_rsa_key | |
| HostKey /etc/ssh/ssh_host_dsa_key | |
| HostKey /etc/ssh/ssh_host_ecdsa_key | |
| HostKey /etc/ssh/ssh_host_ed25519_key | |
| UsePrivilegeSeparation yes | |
| KeyRegenerationInterval 3600 | |
| ServerKeyBits 1024 | |
| SyslogFacility AUTH | |
| LogLevel INFO | |
| LoginGraceTime 120 | |
| PermitRootLogin prohibit-password | |
| StrictModes yes | |
| RSAAuthentication yes | |
| PubkeyAuthentication yes | |
| IgnoreRhosts yes | |
| RhostsRSAAuthentication no | |
| HostbasedAuthentication no | |
| PermitEmptyPasswords no | |
| ChallengeResponseAuthentication yes | |
| PasswordAuthentication yes | |
| X11Forwarding yes | |
| X11DisplayOffset 10 | |
| PrintMotd no | |
| PrintLastLog yes | |
| TCPKeepAlive yes | |
| AcceptEnv LANG LC_* | |
| Subsystem sftp /usr/lib/openssh/sftp-server | |
| UsePAM yes | |
| Match User ubuntu | |
| AuthenticationMethods publickey | |
| Match User !ubuntu | |
| AuthenticationMethods keyboard-interactive |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment