Re: Two factor authentication for SSH with a YubiKey

Kathinka schreef op do 05-09-2013 om 10:30 [+1200]:
> This sounds like something about security and avoiding the current
> snoop-mania sold to the public and gullible politicians with the
> excuse of fear of terrorism but I don't get it:  what are "one-time
> passwords" for?

Mostly repeating what Gene said, but in my own words:

When you log on to most things, you need one factor: something you know,
generally a password. 

Some banks give you a keyring thing that gives you a number that you
have to type in too. This is a second factor: something you have.

The thing with the passwords coming from the "something you have" is
that every time you use them (or alternately, based on the current
time), they are different according to a sequence that is impossible to
predict without the key, which is long and easy to keep private.

The only copies of the key are in the YubiKey and in the phone. So if
someone steals the YubiKey and/or the phone, they have one of the two
things and still can't use it. If someone captures my password, they
have the "thing I know" but not the YubiKey, so they can't use that,
either.

It's not really a defence against government-level snooping for the most
part, though some governments do put password sniffers on computers and
it would defeat that.

As an example, if I log in to a normal server, this happens:

$ ssh server1.kallisti.net.nz
[email protected]'s password: <type my password>
robin@server1:~$ 

.. and I'm logged in. 

If I do this on a server with this set up, this is the process:

$ ssh server2.kallisti.net.nz
Password: <type my password>
One-time password (OATH) for `robin': <press the button on the yubikey>
robin@server2:~$ 

.. and if either of those are wrong or not provided, my login fails.

(OATH is the name of the key generation system, in case you're
wondering.)

Robin.

_______________________________________________
DunLUG mailing list
[email protected]
http://lists.ethernal.org/listinfo/dunlug
DunLUG Wiki - http://dunlug.kallisti.net.nz/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlInvuEACgkQFNNkhamc622BYwCgkaBvDGVMvxz0LK36ewKSQFyM
NmYAn3l5VV3GgdrWH36XaTBpvpbd3oTZ
=7vOB
-----END PGP SIGNATURE-----