Multi-Faktor-Authentifizierung (2FA) problem

# Standard Un*x authentication.

#@include common-auth

# Google Authentication

auth required pam_google_authenticator.so

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication no

PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication yes

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication. Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes

AuthenticationMethods publickey,password publickey,keyboard-interactive

# Standard Un*x authentication.

#@include common-auth

# Google Authentication

auth required pam_google_authenticator.so nullok

# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

Port 22

Protocol 2

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying:

#RekeyLimit default none

# Logging:

SyslogFacility AUTH

LogLevel INFO

# Authentication:

LoginGraceTime 15s

PermitRootLogin no

StrictModes yes

MaxAuthTries 5

MaxSessions 2

DenyUsers root

DenyGroups root

AllowUsers Brandt GameserverRoot VoiceserverRoot

AllowGroups SSHManager GameserverRoot VoiceserverRoot

# Expect .ssh/authorized_keys2 to be disregarded by default in future.

AuthorizedKeysFile %h/.ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

RhostsRSAAuthentication no

#IgnoreUserKnowHosts yes

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication no

PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication yes

# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes

#GSSAPIStrictAcceptorCheck yes

#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication. Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes

AuthenticationMethods publickey,keyboard-interactive

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

X11Forwarding no

X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

#UseLogin no

UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS no

#PidFile /var/run/sshd.pid

MaxStartups 30

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum none

# Lifetime and size of ephemeral version 1 server key

KeyRegenerationInterval 3600

ServerKeyBits 768

# no default banner path

#banner none

# Allow client to pass locale environment variables

AcceptEnv LANG LC_*

# override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

Match User GameserverRoot,VoiceserverRoot Group GameserverRoot,VoiceserverRoot

AuthenticationMethods password publickey

PasswordAuthentication yes

#PubkeyAuthentication no

Match User Brandt Group SSHManager

AuthenticationMethods publickey,keyboard-interactive

PasswordAuthentication no

#PubkeyAuthentication yes

Authenticating with public key "Brandt@ProjectPowerGaming"

Passphrase for key "Brandt@ProjectPowerGaming":

Further authentication required

Using keyboard-interactive authentication.

Password:

Access denied

# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

Port 2788

Protocol 2

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying:

#RekeyLimit default none

# Logging:

SyslogFacility AUTH

LogLevel INFO

# Authentication:

LoginGraceTime 25s

PermitRootLogin no

StrictModes yes

MaxAuthTries 5

MaxSessions 2

# Hinzugefuegt von @Brandt:

DenyUsers root

DenyGroups root

AllowUsers Brandt GameserverRoot VoiceserverRoot

AllowGroups SSHManager GameserverRoot VoiceserverRoot

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.

AuthorizedKeysFile %h/.ssh/authorized_keys .ssh/authorized_keys1 .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!

#PasswordAuthentication yes

PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication yes

# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes

#GSSAPIStrictAcceptorCheck yes

#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication. Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

X11Forwarding no

X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

#UseLogin no

UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS no

#PidFile /var/run/sshd.pid

MaxStartups 30

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum none

# no default banner path

Banner /etc/ssh/AnmeldeBanner

# Allow client to pass locale environment variables

AcceptEnv LANG LC_*

# override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis

Match User Brandt Group SSHManager

AuthenticationMethods publickey,keyboard-interactive

PasswordAuthentication no

Match All

AuthenticationMethods publickey,password

PasswordAuthentication yes

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.

@include common-auth

# Disallow non-root logins when /etc/nologin exists.

account required pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex

# access limits that are hard to express in sshd_config.

# account required pam_access.so

# Standard Un*x authorization.

@include common-account

# SELinux needs to be the first session rule. This ensures that any

# lingering context has been cleared. Without this it is possible that a

# module could execute code in the wrong domain.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# Set the loginuid process attribute.

session required pam_loginuid.so

# Create a new session keyring.

session optional pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.

@include common-session

# Print the message of the day upon successful login.

# This includes a dynamically generated part from /run/motd.dynamic

# and a static (admin-editable) part from /etc/motd.

session optional pam_motd.so motd=/run/motd.dynamic

session optional pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.

session optional pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.

session required pam_limits.so

# Read environment variables from /etc/environment and

# /etc/security/pam_env.conf.

session required pam_env.so # [1]

# In Debian 4.0 (etch), locale-related environment variables were moved to

# /etc/default/locale, so read that as well.

session required pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts

# in the proper default security context. Only sessions which are intended

# to run in the user's context should be run after this.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

# Standard Un*x password updating.

@include common-password

# Google Authentication

auth required pam_google_authenticator.so nullok

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.

#@include common-auth

# Disallow non-root logins when /etc/nologin exists.

account required pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex

# access limits that are hard to express in sshd_config.

# account required pam_access.so

# Standard Un*x authorization.

@include common-account

# SELinux needs to be the first session rule. This ensures that any

# lingering context has been cleared. Without this it is possible that a

# module could execute code in the wrong domain.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# Set the loginuid process attribute.

session required pam_loginuid.so

# Create a new session keyring.

session optional pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.

@include common-session

# Print the message of the day upon successful login.

# This includes a dynamically generated part from /run/motd.dynamic

# and a static (admin-editable) part from /etc/motd.

session optional pam_motd.so motd=/run/motd.dynamic

session optional pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.

session optional pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.

session required pam_limits.so

# Read environment variables from /etc/environment and

# /etc/security/pam_env.conf.

session required pam_env.so # [1]

# In Debian 4.0 (etch), locale-related environment variables were moved to

# /etc/default/locale, so read that as well.

session required pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts

# in the proper default security context. Only sessions which are intended

# to run in the user's context should be run after this.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

# Standard Un*x password updating.

@include common-password

# Google Authentication

auth required pam_google_authenticator.so

# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

Port 2788

Protocol 2

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying:

#RekeyLimit default none

# Logging:

SyslogFacility AUTH

LogLevel INFO

# Authentication:

LoginGraceTime 15s

PermitRootLogin no

StrictModes yes

MaxAuthTries 5

MaxSessions 2

DenyUsers root

DenyGroups root

AllowUsers Brandt GameserverRoot VoiceserverRoot

AllowGroups GameserverRoot VoiceserverRoot

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.

AuthorizedKeysFile %h/.ssh/authorized_keys %h/.ssh/authorized_keys1 %h/.ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes

PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication yes

# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes

#GSSAPIStrictAcceptorCheck yes

#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication. Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

X11Forwarding no

X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

#UseLogin no

UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS no

#PidFile /var/run/sshd.pid

MaxStartups 30

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum none

# no default banner path

Banner /etc/ssh/AnmeldeBanner

# Allow client to pass locale environment variables

AcceptEnv LANG LC_*

# override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis

Match User Brandt Group SSHManager

AuthenticationMethods publickey,keyboard-interactive

Match All

AuthenticationMethods password,publickey

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.

#@include common-auth

# Disallow non-root logins when /etc/nologin exists.

account required pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex

# access limits that are hard to express in sshd_config.

# account required pam_access.so

# Standard Un*x authorization.

@include common-account

# SELinux needs to be the first session rule. This ensures that any

# lingering context has been cleared. Without this it is possible that a

# module could execute code in the wrong domain.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# Set the loginuid process attribute.

session required pam_loginuid.so

# Create a new session keyring.

session optional pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.

@include common-session

# Print the message of the day upon successful login.

# This includes a dynamically generated part from /run/motd.dynamic

# and a static (admin-editable) part from /etc/motd.

session optional pam_motd.so motd=/run/motd.dynamic

session optional pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.

session optional pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.

session required pam_limits.so

# Read environment variables from /etc/environment and

# /etc/security/pam_env.conf.

session required pam_env.so # [1]

# In Debian 4.0 (etch), locale-related environment variables were moved to

# /etc/default/locale, so read that as well.

session required pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts

# in the proper default security context. Only sessions which are intended

# to run in the user's context should be run after this.

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

# Standard Un*x password updating.

@include common-password

# Google Authentication

auth required pam_google_authenticator.so nullok

# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

Port 2788

Protocol 2

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying:

#RekeyLimit default none

# Logging:

SyslogFacility AUTH

LogLevel INFO

# Authentication:

LoginGraceTime 15s

PermitRootLogin no

StrictModes yes

MaxAuthTries 5

MaxSessions 2

# Hinzugefuegt von @Brandt:

DenyUsers root

DenyGroups root

AllowUsers Brandt GameserverRoot VoiceserverRoot

AllowGroups SSHManager GameserverRoot VoiceserverRoot

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.

AuthorizedKeysFile %h/.ssh/authorized_keys %h/.ssh/authorized_keys1 %h/.ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none

#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes

PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication yes

# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes

#KerberosGetAFSToken no

# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes

#GSSAPIStrictAcceptorCheck yes

#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication. Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes

#AllowAgentForwarding yes

#AllowTcpForwarding yes

#GatewayPorts no

X11Forwarding no

X11DisplayOffset 10

#X11UseLocalhost yes

#PermitTTY yes

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

#UseLogin no

UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression delayed

#ClientAliveInterval 0

#ClientAliveCountMax 3

#UseDNS no

#PidFile /var/run/sshd.pid

MaxStartups 30

#PermitTunnel no

#ChrootDirectory none

#VersionAddendum none

# no default banner path

Banner /etc/ssh/AnmeldeBanner

# Allow client to pass locale environment variables

AcceptEnv LANG LC_*

# override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis

Match User Brandt Group SSHManager

AuthenticationMethods publickey,keyboard-interactive

PasswordAuthentication no

Match all

AuthenticationMethods publickey,password

PasswordAuthentication yes