Can I use Google Authenticator to connect to my cluster?

This article is being updated. Please be aware the content herein, not limited to version numbers and slight syntax changes, may not match the output from the most recent versions of Bright. This notation will be removed when the content has been updated. This article, in particular, needs to be updated as it contains references to cmgui, which is not functional in versions of Bright Cluster Manager newer than v7.3.

Yes, Google Authenticator can be used to connect to the cluster via SSH and cmgui. Google Authenticator will not work with the user portal.

Getting the RPMs:

For RHEL:

Either Fedora’s EPEL repository should be enabled, or the RPMs from EPEL should be downloaded manually. The EPEL repository can be enabled as follows:

# sudo yum install epel-release

Or, for various versions of RHEL/CentOS, you can install the EPEL rpm:

• RHEL/CentOS 6:

• RHEL/CentOS 7:

• On RHEL 7 it is recommended to also enable the optional, extras, and HA repositories since EPEL packages may depend on packages from these repositories:

• RHEL/CentOS 8:

• On RHEL 8 it is required to also enable the codeready-builder-for-rhel-8-*-rpms repository since EPEL packages may depend on packages from it:

• On CentOS 8 it is recommended to also enable the PowerTools repository since EPEL packages may depend on packages from it:

Installing the PAM module
For SLES

The pre-packages PAM module can be downloaded from :

https://software.opensuse.org/package/google-authenticator-libpam

or (one line):

# zypper in https://build.opensuse.org/package/binary/security/pam-google-authenticator?arch=x86_64&filename=pam-google-authenticator-1.0-1.1.x86_64.rpm&repository=SLE_11_SP3

For RHEL

# yum install google-authenticator

For Ubuntu 22.04

# apt install libpam-google-authenticator

Configuring the SSH server:

In /etc/ssh/sshd_config ensure the settings match the following:

PasswordAuthentication yes 
ChallengeResponseAuthentication yes
#ChallengeResponseAuthentication no
UsePAM yes

Configure PAM

For RHEL/SLES:

In the PAM file /etc/pam.d/system-auth, a new line will need to be added at the top:

auth required pam_env.so
auth required pam_google_authenticator.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so

For Ubuntu 22.04:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        required      pam_google_authenticator.so
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

auth        required      pam_google_authenticator.so nullok

Add the following script to /etc/profile.d/Z50-setup-totp.sh on the headnode:

#!/bin/bash

if [ ! -f ~/.google_authenticator ]; then
        echo "You need to set up Google Authenticator for two-factor authentication."
        exec google-authenticator --time-based --disallow-reuse --force --no-rate-limit --window-size=3
fi

…

Configure the authenticator for a given account:

Following the link in the text above displays a QR code image in the web browser.

This image can be scanned with a smartphone or tablet camera with the Google Authenticator app.

The next time the system is logged into, a Google Authenticator verification code will be required:

When connecting to CMGUI an extra dialog window will pop-up prompting for the Google Authenticator verification code:

SELINUX:

If using SELINUX, the following line in the PAM configuration file should be used (one line):

Here:
nullok tells PAM to accept null if the user does not have the Google Authenticator configured. In other words, users without dual-factor configured can still log in.

secret= … gives PAM access to the needed key file, even with SELinux installed. 

After that,  the file .google_authenticator must be moved to the .ssh folder of the user. The folder may need to be created. It is best to do this as the user.

The administrator should then start the daemons:
# service sshd restart
# service cmd restart 

Additional tip:
Encrypting the storage of the Android device is recommended, because the secret key of google authenticator is kept on the device. Encryption of android storage comes with standard Android.