Using Google Authenticator for Two Step Auth with SSH

If you run servers that are accessible from the internet, you might have noticed the many many brute-force login attempts to random accounts against your system. While the risk, that one of these brute-force attempts succeeds is very low (if you chose decent passwords), one might come to the conclusion, that simple user- and password authentication is not safe enough for complete peace of mind.

Here is where two-factor auth comes to play. Until now, there were not so much options if you didn’t want to spend any money. Here is where Google Authenticator comes in handy: It makes two-factor auth accessible for the greater public.
It consists of two components:

  • An app for your smartphone, that spits out verification codes
  • A PAM module for you linux box, to validate the verification codes

In this article, I will explain how to get and install the Google auth PAM module for Linux.

First, you have to prepare a build environment by fetching all needed development packages:

root@srv /home/me # apt-get install make libpam0g-dev
The following NEW packages will be installed:
  binutils cpp cpp-4.4 gcc gcc-4.4 libc-dev-bin libc6-dev libgmp3c2 libgomp1 libmpfr4 libpam0g-dev
  linux-libc-dev make manpages-dev

Then, go and grab the source of the Google Authenticator PAM module from

After you got the sources and extracted them from the tarball, you can continue with building the module:

root@srv /home/me # cd libpam-google-authenticator-1.0
root@srv /home/me/libpam-google-authenticator-1.0 # make
root@srv /home/me/libpam-google-authenticator-1.0 # make install

Install the module and setup PAM to use it for SSH logins:

cp /lib/security
cp google-authenticator /usr/local/bin
vim /etc/pam.d/sshd
auth       required

Setup SSHD to ask for the verification codes:

vim /etc/ssh/sshd_config
ChallengeResponseAuthentication yes

Setup the module:

root@srv /home/me/libpam-google-authenticator-1.0 # su me

me@srv:~/libpam-google-authenticator-1.0$ /usr/local/bin/google-authenticator

Do you want authentication tokens to be time-based (y/n) y
Your new secret key is: ...
Your verification code is ...
Your emergency scratch codes are:

Do you want me to update your "/home/me/.google_authenticator" file (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y

After you did everything correctly, you can try to login via SSH and the system should ask you for your verification code:

login as: me
Using keyboard-interactive authentication.
Verification code:
Using keyboard-interactive authentication.

To round up your setup, you should not forget to remove the packages you installed to build the Google Authenticator module:

root@srv /home/me/libpam-google-authenticator-1.0 # apt-get autoremove make libpam0g-dev


Arduino – building open-source electronics prototypes

Arduino is an open-source microprocessor platform to build electronics prototypes. Not only the development tools are open-source, but also the hardware itself. You can download all the necessary plans for it and build your own one, if you want to.

The really cool thing about the Arduino is, that you can program it with the open-source programming language Wiring, which is very straightforward to use.

Of course, being a complete newbie in electronics engineering, I ordered my own Arduino board as a prebuilt base-board – the Arduino Duemilanove
…and finally, it arrived :)

As a first act of familiarization, I started with the very basic “push a button to power the LED” program

int ledPin = 13; // choose the pin for the LED
int inPin = 2;    // choose the input pin (for a pushbutton)
int val = 0;      // variable for reading the pin status

void setup() {
  pinMode(ledPin, OUTPUT);  // declare LED as output
  pinMode(inPin, INPUT);      // declare pushbutton as input

void loop(){
  val = digitalRead(inPin);   // read input value
  if (val == HIGH) {           // check if the input is HIGH (button released)
    digitalWrite(ledPin, LOW);  // turn LED OFF
  } else {
    digitalWrite(ledPin, HIGH);  // turn LED ON