centos6.5使用Google auth进行双因子认证

yum install curl-devel expat-devel gettext-devel openssl-devel zlib-devel -y
yum install gcc perl-ExtUtils-MakeMaker -y
yum remove git -y
yum update -y nss curl libcurl

cd /usr/src
wget https://www.kernel.org/pub/software/scm/git/git-2.1.2.tar.gz
wget https://www.kernel.org/pub/software/scm/git/git-2.1.2.tar.gz --no-check-certificate
tar xzf git-2.1.2.tar.gz
cd git-2.1.2
make prefix=/usr/local/git all
make prefix=/usr/local/git install
echo "export PATH=$PATH:/usr/local/git/bin" >> /etc/bashrc
source /etc/bashrc

#配置git不认证https
git config --global http.sslVerify false

yum install -y git automake libtool pam-devel -y
git clone https://github.com/google/google-authenticator-libpam.git
cd google-authenticator-libpam/
./bootstrap.sh
./configure
make && make install

cp /usr/local/lib/security/pam_google_authenticator.so /lib64/security/

vim /etc/pam.d/sshd
auth       required     pam_google_authenticator.so no_increment_hotp

vim /etc/ssh/sshd_config
    passwordAuthentication  yes
    ChALLENgeResponseAuthentication yes
    UsePAM yes
/etc/init.d/sshd restart

[[email protected] ~]# google-authenticator

Do you want authentication tokens to be time-based (y/n) y
Warning: pasTing the following URL into your browser exposes the OTP secret to Google:
  https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/[email protected]%3Fsecret%3DJQPBXCQ5UjeARJDKW56QG7PX5M%26issuer%3Duu

Your new secret key is: JQPBXCQ5UjeARJDKW56QG7PX5M

Enter code from app (-1 to skip): 441989

Code confirmed

Your emergency scratch codes are:

  15017326

  13268423

  41466235

  66165819

  90381302

Do you want me to update your "/root/.google_authenticator" file? (y/n) y

Do you want to disallow multiple uses of the same authentication

token? This reStricts you to one login about every 30s,but it increases

your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default,a new token is generated every 30 seconds by the mobile app.

In order to compensate for possible time-skew between the client and the server,

we allow an extra token before and after the current time. This allows for a

time skew of up to 30 seconds between authentication server and client. If you

experience problems with poor time synchronization,you can increase the window

from its default size of 3 permitted codes (one prevIoUs code,the current

code,the next codE) to 17 permitted codes (the 8 prevIoUs codes,and the 8 next codes). This will permit for a time skew of up to 4 minutes

between client and server.

Do you want to do so? (y/n) y

If the computer that you are logging into isn‘t hardened against brute-force

login attempts,you can enable rate-limiTing for the authentication module.

By default,this limits attackers to no more than 3 login attempts every 30s.

Do you want to enable rate-limiTing? (y/n) y