SSH Logins With A Key And A Code, And An Exempt Group For Automation

ssh-totp

SSH logins that need a key AND a six-digit code from an authenticator app, for every account outside an exempt group: the secrets held by root, the code in place of a password rather than beside it, the account Ansible logs in with exempt by itself so a playbook can still connect, and the sshd drop-in checked with the whole configuration before it lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No download, and no version to pin. EL 10 packages what this policy needs, so the role installs google-authenticator, openssh-server by name and takes what the distribution ships. What the role owns is the policy and the proof that the host obeys it.

What it changes. /etc/ssh/sshd_config.d/00-iacbazaar-totp.conf (root 0600): AuthenticationMethods publickey,keyboard-interactive:pam, and a Match Group iacbazaar-totp-exempt block that needs the key alone. In /etc/pam.d/sshd, the auth phase asks pam_google_authenticator for the code and no longer includes password-auth; the account, password and session phases are the package's. iacbazaar-totp-enrol USER (in /usr/local/sbin, root only) makes an account's secret in /var/lib/iacbazaar-totp and prints the otpauth:// line an authenticator app reads, and five one-time scratch codes.

Everyone outside the group needs a code from the next login on. An account with no secret is refused after its key is accepted (measured), so enrol each account first, or put it in ssh_totp_exempt_users until it has enrolled. The account this play logs in as is added by itself - read from SUDO_USER, or the account itself when it is root - and the role refuses to touch sshd unless that account is in the group. With become_method: su it cannot tell who logged in, so name the account.

root cannot pass a code. Under PermitRootLogin prohibit-password (the ssh-hardening role's looser setting) sshd hands PAM a dummy password for root, and the code is refused ("Dummy password supplied by PAM", measured), so root logs in with a key only when it is exempt, and not at all otherwise.

The number in the file name keeps sshd running. sshd takes the first value it reads. The ssh-hardening role's 01- file turns keyboard-interactive off; a drop-in numbered 40- was read after it, AuthenticationMethods then named a method that was off, and sshd refused to start (measured). This role's file is 00-, and each candidate is checked in place: the checker puts it under its real name beside the drop-ins already there and runs sshd -t over the whole tree, so the same file named 40- is refused ("Disabled method keyboard-interactive") before it lands. The Match block at the end of the file does not reach the files read after it (measured: sshd -T for a non-member still shows PasswordAuthentication no from the 01- file).

Wrong codes delay the next login from the same address. sshd on EL 10 penalises a source address after failed logins (PerSourcePenalties): after a few wrong codes from one address, the next connection from it - an exempt account's included - was dropped ("drop connection ... penalty: failed authentication", measured). People behind one NAT or bastion share that address with your automation. sshd -T on EL 10 shows the defaults: five seconds per failed login, connections refused once that reaches fifteen, at most ten minutes.

The secrets are root's. Each secret is root 0400 in /var/lib/iacbazaar-totp, read by the PAM module as root (user=root): a user cannot read or replace their own, and a home directory that is not mounted yet locks nobody out. A code that was used is refused (measured), and each secret is written with google-authenticator's rate limit of three tries per 30 seconds (ssh_totp_rate_limit).

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.