Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication).

If not, it might be possible to configure PAM with some sort of keys module set to 'sufficient', then have PAM fall back on two-factor auth paired with pam_unix.

In fact, I'll see if I can get either of those working a bit later today. Seems like it could be neat.

Another option is to whitelist your ip address, and then require 2-factor auth only when you're connecting from a non-whitelisted ip address.

Of course this leaves you a vulnerable to ip spoofing, but adds a ton of convenience and could be a good trade-off.

Yeah but (blind) IP spoofing over the Internet is infeasible nowadays. Maybe 15 years ago when ISN randomization was not the rule (successful attack described in http://web.textfiles.com/hacking/shimomur.txt)

But that's correct, in recent openssh versions, it seems that you can add specific-host-only rules for authentication etc.

You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn't pass it. Not the best way, but one option.

I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can't find the link right off though as I'm at work currently. If I find it, I'll add it here

A ForceCommand example (for Yubikey) is documented here: http://www.tuxz.net/blog/archives/2010/03/17/how_to_quickly_...

Yes, I have seen a patch as well that allowed you to require both an ssh key and a password ... it was an old patch, though, and I can't imagine it would apply cleanly to any recent OpenSSH ...

This is on our list to pay for someone to do, and we'll release it when they do ... it will probably be FreeBSD-centric, but if it's against OpenSSH generally, it should be usable by others...

What happens if you lose your normal password? Why you boot up into single user mode using the console like the old days of when you forgot the root password.

And how do you do that with cloud instances? :)

Some VPS providers offer "console" access to the machine, which would probably allow someone to drop down into single user mode.

http://www.linode.com/faq.cfm#do-you-provide-console-access

Same way you do when you forget the root password on a normal configuration.

Install a new instance! Its all disposable hardware.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

>Yeah but in reality no-one writes it down.

Then that's a process problem that can be solved. It would take a trivial amount of time to screenshot the page and stash them in your wiki or similar.

Those who don't write it down deserve to be locked out.

I've written down mine on three different pieces of paper (in my wallet, my bag and my closet), and also took a screenshot from it and `gpg`-ed it (with a passphrase, so no one can open it unless they know the password) and stored it in a few online repositories, as well as a friend's mailbox.

So, I'll never be locked out from my account.

It's the only sane thing to do!

My scratch codes are in 1Password (for my personal accounts) and LastPass (for work accounts).

People really should do this. It takes 10 seconds, and eliminates having any paper to lose (or keep secure). Copy and paste, and you're done.

Mine are printed out and stored in my safe. They are never used.

> Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

This is your problem. I keep mine (for multiple services) in my wallet, and it's worked out excellently.

Mine are written down in a post-it note stuck to the inside back-flap of my passport.

You can use the same key for all the servers. Just copy the files generated by the 'google-authenticator' app. I don't see any less security in that.

I use ssh keys with this setup. If I login with an ssh key, I don't need the OTP.

How did you manage to do this? You'd have to use PAM for this to work, and PAM and key-based authentication is mutually exlusive, as far as I know.

If you use a google voice number you can just point it to a new phone.

Don't you need to login to do that? Using 2 factor auth..

Yes, so use your backup keys, or a secondary phone number, or a secondary email address... plenty of options.