ubuntu bash 脚本 一键开启 ssh google-authenticator

HughRyu

群友讨论2FA，突然手痒重温了一下ubuntu安装 ssh google-authenticator流程。
为了作为记录，整理个脚本，顺便和大家共享一下。

可以手动选择是否同时开启密码访问，执行后生成相关信息存于~/ga2fa.txt
具体内容详见脚本注释。

ubuntu bash script  ssh over TOTP(2FA) by google-authenticator

####################################################################################
  
#The operation instructions are in accordance with Ubuntu official guidelines.
#Reference: https://ubuntu.com/tutorials/configure-ssh-2fa#1-overview

#!/bin/bash

# Install Google Authenticator PAM module
sudo apt install -y libpam-google-authenticator

# Generate Google Authenticator secrets and QR codes and store the output in ~/ga2fa.txt
# -t: Generate time-based tokens
# -f: Force output to a file
# -d: Disable base32 encoding
# -w 3: Set the window size to 3
# -e 10: Set the issue period to 10 seconds
# -r 3: Set the scratch window size to 3
# -R 30: Set the recovery window size to 30
# tee ~/ga-output.txt: Redirect the output to the ~/ga-output.txt file

google-authenticator -t -f -d -w 3 -e 10 -r 3 -R 30 | tee ~/ga2fa.txt

# Enable challenge-response passwords for SSH
sudo sed -i 's/^#ChallengeResponseAuthentication no$/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
sudo sed -i 's/^ChallengeResponseAuthentication no$/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config


# Prompt the user to enable or disable password authentication
echo -n "Do you want to enable password authentication for SSH? (y/n) "
read -t 10 -p "Default is 'y' (Enable_password): " enable_password

# Check if the user entered a valid response
if [ -z "$enable_password" ]; then
    enable_password="y"  

# Enable or disable password authentication based on the user's response
if [ "$enable_password" == "y" ]; then
    sudo sed -i 's/^#PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config
    sudo sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config
    echo "Password authentication enabled."
elif [ "$enable_password" == "n" ]; then

    sudo sed -i 's/^PasswordAuthentication yes/#PasswordAuthentication no/' /etc/ssh/sshd_config
    echo "Password authentication disabled."
else
    echo "Invalid input. Please enter 'y' to enable or 'n' to disable password authentication."
fi

# Restart SSH service
sudo systemctl restart sshd.service
####################################################################################
Google-Authenticator_AutoConfigScript_for Ubuntu.zip (1004 Bytes, 下载次数: 2)

2024-5-25 14:54 上传

点击文件名下载附件

rhci

嗯，喜欢看这种代码，就是不知道这个是干啥的

crazy_hb

不说明的一定都是有大用处的~懂的研究收藏， 和我一样不懂的凑热闹就行。。。

gy6007

我也很赞同楼上的说法~字越少东西越厉害~！呵呵