Shell: Unterschied zwischen den Versionen

Aus Doc-Wiki
Zur Navigation springen Zur Suche springen
imported>Gtest2
imported>Burghardt
(45 dazwischenliegende Versionen von 3 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
  +
* '''Alternative Anleitung''' von C. Damm [https://univz.uni-goettingen.de/qisserver/rds?state=verpublish&status=init&vmfile=no&moduleCall=webInfo&publishConfFile=webInfoPerson&publishSubDir=personal&keep=y&purge=y&personal.pid=8786] in deutscher Sprache: https://user.informatik.uni-goettingen.de/~damm/info1/aktuell/2FA.html
  +
* Please read [[Long Running Processes]] if you want to run an application for a longer time
  +
* Please '''do log out when you have finished your work!''' Currently more than 30% of all users leave their idle session running for days and weeks :-(
  +
  +
<!--
 
{| style="border: 1pt black dashed"
 
{| style="border: 1pt black dashed"
 
|-
  
|-
−
| [[Image:Diamond-caution.png]] || '''Beta Test!''' Please give feedback via '''<tt>feedback(ät)informatik.uni-goettingen.de</tt>'''<br /><small>For problem reports: please include ''always'' information about your system - the exact date+time, your IP address, your user id, what you ''wanted'' to accomplish, what you ''did'' and what happened ''instead''.</small>|| [[Image:Diamond-caution.png]]
 +
| [[Image:Diamond-caution.png]] || '''Beta Test!''' Please give feedback via '''<tt>feedback(ät)informatik.uni-goettingen.de</tt>'''<br /><small>For problem reports: please include ''always'' information about your system - ''at least'' the exact date+time, your IP address, your user id, what you ''wanted'' to accomplish, what you ''did'' and what happened ''instead''.<br />To remove this warning I need some ''positive'' feedback first...</small>|| [[Image:Diamond-caution.png]]
 
|-
  
|-
 
|}
  
|}
  +
-->
−  
   
   
Zeile 11: Zeile 16:
   
 
<big>
  
<big>
−
~# ssh username@shell.stud.informatik.uni-goettingen.de
+
~# '''ssh username@shell.stud.informatik.uni-goettingen.de '''
 
####### shell.stud.informatik.uni-goettingen.de - login vm: shell5.cip.loc
  
####### shell.stud.informatik.uni-goettingen.de - login vm: shell5.cip.loc
 
...
  
...
Zeile 20: Zeile 25:
 
</big>
  
</big>
   
  +
=== Verify Key Fingerprint ===
  +
The first time you connect to ''any'' ssh-reachable resource via an unstrusted network you need to verify the fingerprint of the used key and ''only then accept it''. For our <tt>shellX</tt>-machines the set of valid public key fingerprints is:
  +
ECDSA 07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd
  +
ED25519 93:11:29:c4:a2:03:e1:2d:b1:82:05:74:dd:a5:3b:9a
  +
RSA de:db:6e:72:52:de:30:73:db:bb:6e:79:df:f9:2c:0d
  +
<!-- <small>(On any server <tt>root</tt> can do this: <tt> ~# for F in /etc/ssh/*.pub ; do ssh-keygen -lf $F; done</tt>)</small> -->
   
  +
=== Target audience ===
  +
These machines are meant to be used by students. But ''of course'' they can be used by all staff members!
   
  +
First time users: the only pre-condition is to logon one single time using one of the (physical) pool computers in our building - this will make you a "known user" to our systems. Only then you can (and must) walk through [[#2FA]].
−
For '''Windows''': use [[PuTTY]] (simple) or [[Cygwin]] (more complex and powerful) or any other SSH-implementation.
  
−  
−  
−
=== Target audience ===
  
−
These machines are meant to be used by students. But ''of course'' they can be used by any staff members!
 
   
  +
=== Windows ===
−
For first time users: the only requirement is to logon one single time using one of the (physical) pool computers in our building - this will make you a "known user" to our systems. Additionally you need to walk through [[#2FA]].
  
  +
For '''Windows''': use [[PuTTY]] (simple) or [[Cygwin]] (more complex and powerful) or any other SSH-implementation. [[Bash on Ubuntu on Windows]] works great too.
   
 
=== Load Balancing ===
  
=== Load Balancing ===
−
In fact this term is misleading on this specific installation as it simple does "round-robin", at least for now. The important point is that you'll get connected to ''any'' currently available login machine. This will be the "next" machine one after another and probably ''not'' the same one as one session before. If you landed on an overcrowded system simply disconnect/reconnect to use another machine.
 +
In fact this term is misleading on this specific installation as it simply does "round-robin", at least for now. The important point is that you'll get connected to ''any'' currently available login machine. This will be the "next" machine one after another and probably ''not'' the same one as one session before. If you landed on an overcrowded system simply disconnect/reconnect to use another machine.
 
<!--
  
<!--
 
=== Legacy <tt>login.stud</tt> ===
  
=== Legacy <tt>login.stud</tt> ===
Zeile 46: Zeile 56:
 
-->
  
-->
   
  +
== Self defense of these servers ==
−  
  +
Only relevant if your system fails to connect with errors like <tt>Server not reachable</tt>: [[Shell/Self Defense]]
−  
−
== Self defense of these servers = Rate Limiting ==
  
−
{| style="border: 1pt black dashed"
 
−
|-
  
−
| [[Image:Diamond-caution.png]] || We do limit the rate of ''new'' <tt>ssh</tt>- (<tt>tcp</tt>-) connections from each source IP address to '''10 per minute'''. If you hit this limit your source IP address is blocked for 5 minutes.<br /><small>The parameters are in flux and may change without further notice.</small>|| [[Image:Diamond-caution.png]]
  
−
|-
  
−
|}
  
−  
−  
−  
−
<!--
  
−
=== Port knocking ===
  
−
For security reasons a "port knocking daemon" got installed. It works like a secret knocking sequence at the door of a conspiracy meeting: only after you have successfully performed that secret sequence the door is opened ''for a moment''. In our technical context this means that the listening <tt>sshd</tt> is ''reachable'' '''for 300 seconds''' after knocking...
  
−  
−
{| style="border: 1pt black dashed"
 
−
|-
  
−
| [[Image:Diamond-caution.png]] || Secret: 33778 &bull; 22999 &bull; 44333 || [[Image:Diamond-caution.png]]
  
−
|-
  
−
|}
  
−  
−
{| style="border: 1pt black dashed"
 
−
|-
  
−
| [[Image:Diamond-caution.png]] || This approach will get removed during the next days... || [[Image:Diamond-caution.png]]
  
−
|-
  
−
|}
  
−  
−  
−
Successfully triggering is possible using a variety of software tools:
  
−  
−
* [[#Linux]]
  
−
* [[#Windows]]
  
−
* [[#Android]]
  
−
* [[#OS agnostic Web Browser]]
  
−  
−
==== Linux ====
  
−
If you are using Linux and the package <tt>knockd</tt> is actually installed (which is not a requirement!) you can use this one-liner to log in:
  
−
~$ knock shell.stud.informatik.uni-goettingen.de 33778 22999 44333 && sleep 1; ssh username@shell.stud.informatik.uni-goettingen.de
  
−  
−
If this fails try a slower version:
  
−
~$ knock shell.stud.informatik.uni-goettingen.de 33778; knock shell.stud.informatik.uni-goettingen.de 22999; knock shell.stud.informatik.uni-goettingen.de 44333 && sleep 1; ssh username@shell.stud.informatik.uni-goettingen.de
  
−  
−  
−
''Without'' having the package <tt>knockd</tt> installed: <tt>telnet</tt> to the rescue!
 
−
~$ telnet shell.stud.informatik.uni-goettingen.de 33778
  
−
~$ telnet shell.stud.informatik.uni-goettingen.de 22999
  
−
~$ telnet shell.stud.informatik.uni-goettingen.de 44333
  
−
~$ ssh username@shell.stud.informatik.uni-goettingen.de
  
−  
−  
−  
−
[[Image:knockknock.png|343px|right]]
  
−  
−
==== Windows ====
  
−
* <tt>telnet</tt> is included in Windows also. But it is not ''installed'' by default. You need to activate it through "Windows-Features aktivieren oder deaktivieren"/"Add windows features" "Telnet-Client". You need Administrator privileges to do so, so this is not an option on foreign computers
  
−
* There are dedicated tools available for this purpose. This one is tested and found to work as expected: https://sourceforge.net/projects/knockknock/ <br />The zip-file contains a (surprisingly small) executable. It is usable without installation, so you do ''not'' need Admin privileges
  
−
* Use a web browser to tickle those ports
  
−
* <small><tt>telnet</tt> is included in Windows also, but unfortunately it seems not to work reliably. During reproducible tests the ''third'' knock did not reach the server while the first two were handled correctly</small>
  
−
&nbsp;<br />&nbsp;
  
−  
−
==== Android ====
  
−
"Port Knocker" via [[F-Droid]]: It is recommended to integrate that repository by installing https://f-droid.org/FDroid.apk. A direct link to the relevant package is: https://f-droid.org/repo/com.xargsgrep.portknocker_8.apk
  
−  
−
This tool allows an arbitrary application to launch automatically after knocking. Tested successfully with [[ConnectBot]].
  
−  
−  
−
==== OS agnostic Web Browser ====
  
−  
−
Create a new folder for these bookmarks. Prepare three Bookmarks:
 
−
** http://shell.stud.informatik.uni-goettingen.de:33778
  
−
** http://shell.stud.informatik.uni-goettingen.de:22999
  
−
** http://shell.stud.informatik.uni-goettingen.de:44333
  
−  
−
Of course you will end up running into a timeout as ''there is no webserver listening''. You do not have to wait for timeout; simply cancel loading...
  
−  
−
You can "click" them one after another. Browsers like [[Firefox]] offer a context menu entry "Alle in Tabs öffnen"/"Open all bookmarks" which tries to do what it says. You need to close all three of them one by one though.
  
−
-->
  
   
 
== 2FA ==
  
== 2FA ==
−
''Two Factor Authentication'' -- '''required, not optional'''
 +
''Two Factor Authentication'' -- '''required, not optional!'''
   
 
=== Concept ===
  
=== Concept ===
−
We use the well known <tt>google-authenticator</tt> to add a second factor as a requirement for (ssh-) logins. ''First'' you will get prompted for a "Verification code:". Then you'll get a second prompt asking for your normal "Password:".
+
We use the well known <tt>google-authenticator</tt> to add a second factor as a requirement for (ssh-) logins. ''First'' you will get prompted for a "Verification code:". Then you'll get a second prompt asking for your normal password.
   
−
The "Verification Code" changes every minute, this approach is called TOTP = Time-based One Time Password.
+
The "Verification Code" changes every minute, this approach is called TOTP = '''T'''ime-based '''O'''ne '''T'''ime '''P'''assword.
   
 
<small>(Do not try to use "Counter based OTP". It might work first, but it will do so only for a short while! We are using ''copies'' of the secret file. State updates required by the incremental counter strategy are ''not'' written back. Authentication will fail after reaching the windows size.) </small>
  
<small>(Do not try to use "Counter based OTP". It might work first, but it will do so only for a short while! We are using ''copies'' of the secret file. State updates required by the incremental counter strategy are ''not'' written back. Authentication will fail after reaching the windows size.) </small>
Zeile 144: Zeile 79:
 
Before you can use this technology the first time you need to prepare your personal secret credentials. You do this by using a simple command line tool and answering some questions.
  
Before you can use this technology the first time you need to prepare your personal secret credentials. You do this by using a simple command line tool and answering some questions.
   
−
Of course you can not do this on these shellX-machines as you can not login successfully (chicken-and-egg problem). '''Use one of the physical pool computers for this!''' <!-- or login.stud.informatik.uni-goettingen.de instead. -->
 +
Of course you can not do this on these shellX-machines as you can not login successfully - this is the classic chicken-and-egg problem. '''Use one of the physical pool computers for this!'''
  +
  +
(Your personal/private computer is probably ''not'' an option as you need access to your OpenAFS <tt>$HOME</tt>. If you ''do'' have access you might need to install the software by <tt>apt-get install libpam-google-authenticator</tt> which contains the required binary.)
 
 
 
''The following instructions are copy-n-pastable as the commands are relative to anyones <tt>$HOME</tt>-folder. ''
 
''The following instructions are copy-n-pastable as the commands are relative to anyones <tt>$HOME</tt>-folder. ''
Zeile 151: Zeile 88:
 
Do you want authentication tokens to be time-based (y/n) '''y'''
  
Do you want authentication tokens to be time-based (y/n) '''y'''
 
... <small># For full output see [[Shell/2fa-example]]</small>
  
... <small># For full output see [[Shell/2fa-example]]</small>
  +
  +
=== Create dedicated sub-directory ===
  +
  +
For '''new''' accounts the folder <tt>.ifi-login</tt> is created automatically on first login. If it actually exists already you can skip nearly this complete block and jump to ''the next section [[#Move_credential_file]] with the <tt>mv .google_authenticator</tt>-command''.
  +
  +
A successful check:
  +
~$ file .ifi-login
  +
.ifi-login: directory
  +
A missing folder gives:
  +
~$ file .ifi-login
  +
.ifi-loginx: cannot open `.ifi-login' (No such file or directory)
  +
  +
----
   
 
Due to some unusual behavior of [[OpenAFS]] regarding access rights (<small>they work ''only'' on directories, not on files</small>) we need to move that file into another, dedicated subdirectory. This man page explains the access rights mechanism and how to manipulate ''access-control-lists'':
  
Due to some unusual behavior of [[OpenAFS]] regarding access rights (<small>they work ''only'' on directories, not on files</small>) we need to move that file into another, dedicated subdirectory. This man page explains the access rights mechanism and how to manipulate ''access-control-lists'':
Zeile 159: Zeile 109:
 
~$ fs sa -dir .ifi-login -acl ifi-login read
 
~$ fs sa -dir .ifi-login -acl ifi-login read
 
~$ fs sa -dir . -acl ifi-login l
  
~$ fs sa -dir . -acl ifi-login l
  +
  +
Be aware that we are working with "dotfiles": both <tt>.ifi-login</tt> & <tt>.google_authenticator</tt> begin with a "." and are usually ''hidden'' from users eye. To see them use '''<tt>ls -a</tt>'''.
   
 
As usual access rights are inherited. For this reason there are more rights granted than required. You ''might'' remove them now by commands like
  
As usual access rights are inherited. For this reason there are more rights granted than required. You ''might'' remove them now by commands like
Zeile 175: Zeile 127:
   
 
'''WARNING:''' do not remove rights if you are not absolutely sure they are not needed. ''It is very easy to remove too many rights'', leaving you with a directory that is not usable anymore!
  
'''WARNING:''' do not remove rights if you are not absolutely sure they are not needed. ''It is very easy to remove too many rights'', leaving you with a directory that is not usable anymore!
  +
  +
=== Move credential file ===
   
 
Now move the created credential file into that new destination:
  
Now move the created credential file into that new destination:
Zeile 184: Zeile 138:
 
{| style="border: 1pt black dashed"
 
{| style="border: 1pt black dashed"
 
|-
  
|-
−
| [[Image:Diamond-caution.png]] || The system time is used equivalent to a shared secret! Make sure your clock is set correctly or all generated codes will fail.
 +
| [[Image:Diamond-caution.png]] || The '''system time''' is used equivalent to a shared secret! Make sure your clock is set correctly or all generated codes will fail.
 
|-
  
|-
 
|}
  
|}
Zeile 208: Zeile 162:
 
* Windows:
  
* Windows:
 
** WinAuth: https://github.com/winauth/winauth -- <small>direct download as of 06.2016: https://winauth.com/downloads/3.x/WinAuth-3.5.1.zip</small><br />This is an installation-free application, no setup and no administrative access needed.
 
** WinAuth: https://github.com/winauth/winauth -- <small>direct download as of 06.2016: https://winauth.com/downloads/3.x/WinAuth-3.5.1.zip</small><br />This is an installation-free application, no setup and no administrative access needed.
  +
  +
* Windows Phone:
  +
** Token2: free application from Microsoft Store. The QR-Code seems to be incompatible, so you need to type in your secret manually. Nevertheless: ''it works''.
  +
   
 
* OS agnostic
  
* OS agnostic
Zeile 215: Zeile 173:
 
== Tips 'n' Tricks ==
  
== Tips 'n' Tricks ==
   
−
=== Connect to a specific machine ===
 +
=== Connecting to a specific machine ===
  +
If you are trying to connect to the ''same machine as last time'' (for example to execute [[Long Running Processes]]) you need to connect from a ''semi-local source address'' which includes:
−
If your are using a ''semi-local source address'' from inside Gönet or inside the Institute = <tt>134.76.0.0/16</tt> + <tt>10.0.0.0/8</tt> + <tt>172.16.0.0/12</tt> circumventing the Round-Robin mechanism is possible: connect to a specific port <tt>42000+''n''</tt> with <tt>''n''={1..6}</tt>
  
  +
* <tt>134.76.0.0/16</tt> - official Gönet address space
−  
  +
* <tt>10.0.0.0/8</tt> - official Gönet wide routed RFC1918 address space
−
For machine number 4:
  
  +
* <tt>172.16.0.0/12</tt> - Institute local address space
  +
In this case circumventing the Round-Robin mechanism is possible by connecting to a specific port <tt>42000+''n''</tt> with <tt>''n''={1..6}</tt>. The example connects to machine number 4:
 
 
 
~$ ssh -p 42004 username@shell.stud.informatik.uni-goettingen.de
  
~$ ssh -p 42004 username@shell.stud.informatik.uni-goettingen.de
Zeile 245: Zeile 205:
 
== Todo ==
  
== Todo ==
 
* Testing! -- the current state is considered "BETA"
  
* Testing! -- the current state is considered "BETA"
  +
* ssh-ed25519
 
<!-- * make Status Information publicly available? -- ''probably not'' -->
  
<!-- * make Status Information publicly available? -- ''probably not'' -->
 
<!-- * possibly require 2FA only from outside the Institute? -- ''Not decided yet'' -->
  
<!-- * possibly require 2FA only from outside the Institute? -- ''Not decided yet'' -->
Zeile 254: Zeile 215:
   
 
== Links ==
  
== Links ==
  +
* https://user.informatik.uni-goettingen.de/~damm/info1/aktuell/2FA.html -- '''Alternative Anleitung''' von C. Damm[https://univz.uni-goettingen.de/qisserver/rds?state=verpublish&status=init&vmfile=no&moduleCall=webInfo&publishConfFile=webInfoPerson&publishSubDir=personal&keep=y&purge=y&personal.pid=8786] in deutscher Sprache
 
* https://tools.ietf.org/html/rfc6238
  
* https://tools.ietf.org/html/rfc6238
 
* https://github.com/google/google-authenticator
  
* https://github.com/google/google-authenticator

Version vom 10. März 2017, 09:41 Uhr


Usage

Please read #2FA for initial setup. Then simply use SSH to login to this machine: 

~# ssh username@shell.stud.informatik.uni-goettingen.de 
#######  shell.stud.informatik.uni-goettingen.de - login vm: shell5.cip.loc
...
Verification code: 
Password: 
Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-87-generic x86_64)
username@shell5:~$

Verify Key Fingerprint

The first time you connect to any ssh-reachable resource via an unstrusted network you need to verify the fingerprint of the used key and only then accept it. For our shellX-machines the set of valid public key fingerprints is: 

ECDSA   07:84:c9:e1:59:4f:03:75:69:b1:e4:d0:b4:1f:9a:cd
ED25519 93:11:29:c4:a2:03:e1:2d:b1:82:05:74:dd:a5:3b:9a 
RSA     de:db:6e:72:52:de:30:73:db:bb:6e:79:df:f9:2c:0d

Target audience

These machines are meant to be used by students. But of course they can be used by all staff members!

First time users: the only pre-condition is to logon one single time using one of the (physical) pool computers in our building - this will make you a "known user" to our systems. Only then you can (and must) walk through #2FA.

Windows

For Windows: use PuTTY (simple) or Cygwin (more complex and powerful) or any other SSH-implementation. Bash on Ubuntu on Windows works great too.

Load Balancing

In fact this term is misleading on this specific installation as it simply does "round-robin", at least for now. The important point is that you'll get connected to any currently available login machine. This will be the "next" machine one after another and probably not the same one as one session before. If you landed on an overcrowded system simply disconnect/reconnect to use another machine.

Timeout

  • The session Timeout is set to 36 hours -- this is the HAproxy related Timeout regarding the TCP connection
  • Kerberos/OpenAFS have separate/shorter timeouts, usually 10 hours. Please check with klist. You need to run kinit && aklog when you're approaching timeout


Self defense of these servers

Only relevant if your system fails to connect with errors like Server not reachable: Shell/Self Defense

2FA

Two Factor Authentication -- required, not optional!

Concept

We use the well known google-authenticator to add a second factor as a requirement for (ssh-) logins. First you will get prompted for a "Verification code:". Then you'll get a second prompt asking for your normal password.

The "Verification Code" changes every minute, this approach is called TOTP = Time-based One Time Password.

(Do not try to use "Counter based OTP". It might work first, but it will do so only for a short while! We are using copies of the secret file. State updates required by the incremental counter strategy are not written back. Authentication will fail after reaching the windows size.)

The order of both inputs is relevant: if an attacker manages to crack the first element (being the TOTP) he has a benefit for some minutes only. If we would ask for the Password first then the benefit of cracking the first element gives advantages probably for a very long time.


You need to have a compatible generator - usually implemented as a small application.

Please note that often this approach is associated with a specific implementation: the Google Authenticator. This is misleading as there are other 100% compatible implementations. See also RFC 6238.

Initialization

Before you can use this technology the first time you need to prepare your personal secret credentials. You do this by using a simple command line tool and answering some questions.

Of course you can not do this on these shellX-machines as you can not login successfully - this is the classic chicken-and-egg problem. Use one of the physical pool computers for this!

(Your personal/private computer is probably not an option as you need access to your OpenAFS $HOME. If you do have access you might need to install the software by apt-get install libpam-google-authenticator which contains the required binary.)

The following instructions are copy-n-pastable as the commands are relative to anyones $HOME-folder. 

~$ google-authenticator      
Do you want authentication tokens to be time-based (y/n) y
... # For full output see Shell/2fa-example

Create dedicated sub-directory

For new accounts the folder .ifi-login is created automatically on first login. If it actually exists already you can skip nearly this complete block and jump to the next section #Move_credential_file with the mv .google_authenticator-command.

A successful check: 

~$ file .ifi-login
.ifi-login: directory

A missing folder gives: 

~$ file .ifi-login
.ifi-loginx: cannot open `.ifi-login' (No such file or directory)

Due to some unusual behavior of OpenAFS regarding access rights (they work only on directories, not on files) we need to move that file into another, dedicated subdirectory. This man page explains the access rights mechanism and how to manipulate access-control-lists: 

~$ man fs_setacl

First you need to create that directory. A special user with the name ifi-login needs to have read access to the files in the directory .ifi-login inside of your $HOME. To be able to reach into that directory he needs to "walk through" your home folder. The third line is required to make this possible by granting "l"="list" access rights to your $HOME: 

~$ mkdir .ifi-login     
~$ fs sa -dir .ifi-login -acl ifi-login read 
~$ fs sa -dir . -acl ifi-login l

Be aware that we are working with "dotfiles": both .ifi-login & .google_authenticator begin with a "." and are usually hidden from users eye. To see them use ls -a.

As usual access rights are inherited. For this reason there are more rights granted than required. You might remove them now by commands like 

~$ fs sa -dir .ifi-login -acl mta none
~$ fs sa -dir .ifi-login -acl spamassassin none
~$ fs sa -dir .ifi-login -acl web-home none

You can always check the current settings. At the end it may look like this: 

~$ fs la .ifi-login
Access list for .ifi-login is
Normal rights:
 system:administrators rlidwka
 username rlidwka
 username.system rl
 ifi-login rl    # this is the important one (in this context)

WARNING: do not remove rights if you are not absolutely sure they are not needed. It is very easy to remove too many rights, leaving you with a directory that is not usable anymore!

Move credential file

Now move the created credential file into that new destination: 

~$ mv .google_authenticator .ifi-login/

Please remember to repeat this step if you modify/recreate your configuration!

Generators

Diamond-caution.png The system time is used equivalent to a shared secret! Make sure your clock is set correctly or all generated codes will fail.

For all generators you need the secret created above. You can use any tool you want to look into the file .ifi-login/.google_authenticator. A one-liner which outputs only the "secret" is this: 

~$ head -n1 .ifi-login/.google_authenticator 
P2ZOMKQLEIC6SKCL
Winauth+putty.png
  • Linux
    • install oathtool to get some compatible command line utilities. Then this works:
~$ oathtool --totp -b $(head -n1 .ifi-login/.google_authenticator)
123456
  • Ubuntu Touch
    • Authenticator
  • Windows Phone:
    • Token2: free application from Microsoft Store. The QR-Code seems to be incompatible, so you need to type in your secret manually. Nevertheless: it works.


Tips 'n' Tricks

Connecting to a specific machine

If you are trying to connect to the same machine as last time (for example to execute Long Running Processes) you need to connect from a semi-local source address which includes:

  • 134.76.0.0/16 - official Gönet address space
  • 10.0.0.0/8 - official Gönet wide routed RFC1918 address space
  • 172.16.0.0/12 - Institute local address space

In this case circumventing the Round-Robin mechanism is possible by connecting to a specific port 42000+n with n={1..6}. The example connects to machine number 4: 

~$ ssh -p 42004 username@shell.stud.informatik.uni-goettingen.de
#######
#######  shell.stud.informatik.uni-goettingen.de - login vm: shell4.cip.loc


Duplicate your Generators

It is absolutely fine to have a well configured generator on every single device you own. Remember: without the second factor you can not login. That's the goal of the whole shebang after all.

Write down your Emergency codes

Remember the console output during creation of the secret? "Your emergency scratch codes are:...". Write them down (or print them) and put that piece of paper into your pocket...

Credential problems

  • problems with the Verification Code: simply start again with #Initialization and overwrite ~/.ifi-login/.google_authenticator. You need to re-configure all of your #Generators of course

Todo

  • Testing! -- the current state is considered "BETA"
  • ssh-ed25519

See also

Links

Abgerufen von „https://doc.informatik.uni-goettingen.de/wiki/index.php?title=Shell&oldid=938“