(upbeat music)
- Enabling two-factor authentication
is becoming a lot more common.
But did you know you can do it in your Raspberry Pi?
Now two-factor authentication
is an extra layer of protection,
as well as something you know; your password.
You'll be asked for another piece of information,
a second factor, every time you log in.
Now this could be something you have,
like a smartphone or something you are,
like a biometric information.
What we're gonna do is go ahead
and set up something you have, your smartphone,
to help you protect your Raspberry Pi.
Afterwards, once you've enabled two-factor authentication
every time you log in remotely via SSH,
you'll be prompted for verification code,
as well as your password.
You gonna need a smartphone, your laptop,
and of course your Raspberry Pi.
But before we do that, we gonna make sure that your running
the latest version of the operating system.
Upgrading your operating system is the simplest
you can do, to keep your Raspberry Pi secure,
and you should do it frequently.
And if you running a relatively recent version
of the operating system,
you can do it from the command line.
Just go ahead and open up the terminal and type,
sudo apt-get update
sudo apt-get full-upgrade
And depending how long it's been
since you've done this before,
it could take fair well to upgrade.
Don't worry about it, go have a cup of coffee,
it's gonna be well with your time.
The Raspberry Pi operating system
has an SSH server disabled on boot.
So when need to enable it
as if we what to SSH into our Raspberry Pi.
And the easiest way to do that is to go to the Desktop menu.
So go up to the Raspberry Pi icon,
go down to preferences, and Raspberry Pi configuration.
And then go to interfaces, and just click to enable SSH,
and it's okay.
Next we need to tell the SSH daemon
to enable challenge response passwords.
So go ahead and open the SSH config file,
sudo nano /etc/ssh/sshd _config.
So we need to change the Challenge Response Authentication
from the default, no, to yes.
So just scroll down,
until you reach Challenge Response Authentication
and change that to yes,
and hit Control + X, and Y to save.
And then we need to restart the SSH daemon.
So sudo systemctl restart ssh
It's a good idea to open up a terminal
on your laptop right now, and make sure you can still SSH
into your Raspberry Pi at this point.
Although you won't be prompted
for the two-factor authentication code quite yet.
It sensible to check that
everything still works at this stage.
So the first thing you need to do
to install two-factor authentication
is to download an app to your phone.
One that's gonna generate the time-based one-time password.
One of the most commonly used is Google Authenticator.
It's available for Android, iOS, and Blackberry.
And there's even an open source version
of the app available on GitHub.
So just go to the App Store,
go ahead and search for Google Authenticator,
and then download it onto your phone.
Once you've done that, you can go ahead and open it,
and begin set up.
You can see down at the bottom here
we're offered a scan barcode and manual entry.
We'll get to that.
First, we have to go back to our Raspberry Pi
and install the Google Authenticator PAM module.
So just go back to your terminal again,
and it's sudo apt install libpam-google-authenticator
Yes to continue.
And now we have two-factor authentication installed
on both our phone and our Raspberry Pi,
we're ready to get things configured.
Go ahead and run the Google Authenticator application
from the command line without using sudo
because we're configuring it for our own user account,
the Pi User Accounts.
So just type, google-authenticator
as the command line and hit return.
And answer y for yes, to whether you want time-based tokens.
You'll see this looks a bit odd,
but if we just resize our terminal window,
we have a QR code.
Don't move forward quite yet.
Before you do anything else,
you should copy the emergency codes
down below the QR code and put them somewhere safe.
These codes will let you access the Raspberry Pi
and turn off two-factor authentication,
if you lose your phone.
Without them you won't be able to Secure Shell
into your Raspberry Pi if you lose or break the device
you're trying to use to authenticate with.
So next before we continue with Google Authenticator
on the Raspberry Pi,
we need to set up Google Authenticator on your phone.
So go ahead and open the app and hit scan barcode.
If this is the first time you're using the app,
you will be asked whether to give it permissions
to open your camera.
You should give them those permissions,
and then you'll have the ability to scan a barcode.
So just, point your phone at the screen,
center the barcode in the green box,
and your phone will read it
and then start generating one-time passwords.
You phone will generate a new one-time password,
every 30 seconds.
However, this code isn't gonna be all that useful
until we finish off what we were doing on the Raspberry Pi.
So switch back to your terminal window and answer y for yes,
when asked whether Google Authenticator
should update your dot Google Authenticator file.
And answer y for yes, when asked whether you should
disallow multiple uses of the same authentication token,
and answer n for no to increasing the time-skew window.
And finally, y for yes, to rate limits in order to protect
against brute force attacks,
we're done here.
Now what we have to do is enable two-factor authentication.
We're gonna go ahead and use
the Linux pluggable authentication module, PAM,
which provides dynamic authentication support
for applications and services
to add two-factor authentication to SSH on the Raspberry Pi.
So we need to configure PAM to add to auth.
So all we need to do is,
sudo nano/etc/ pam.d/sshd
We're going to need the add the line
auth required pam_google_authenticator.so
so to the top of this file.
You can either do this above or below the line
that says, @include common-auth
Since I prefer to be prompted for my verification code
after entering my password,
I'm going to add this line after the @ include line.
If you want to be prompted for the code
before entering your password,
you should add it before the @ include line.
So go ahead and type,
off required pam google authenticator.so,
then hit Control + X to save the file.
Yes to lower the buffer, and hit return.
Now all we have to do is restart the SSH daemons.
So, sudo systemctrl restart ssh
If everything's gone to plan,
next time you SSH into your Raspberry Pi.
You should be prompted for a verification code
after being prompted for your password.
So go to your laptop,
open a terminal window and Secure Shell
into your Raspberry Pi.
If this is the first time you've SSH into the PI,
you'll be prompted for to verify the key fingerprint,
just type yes.
And you'll be asked for your passwords.
And now you'll also be asked
for your verification code.
So grab your phone, open your authenticator app,
and type in the verification code,
638331 is what I have.
And you've successfully two-factor authenticated
to your Raspberry Pi.
You'll now need your phone and the one-time password
every time you SSH or SCP to and from your Raspberry Pi.
But because of that, you've just given yourself
a huge boost to the security of your device.
And now you have the authenticator app in you're Phone,
you should think about where else you can use it,
like Google, or Amazon, or other online accounts.
Because two-factor authentication is one of the easiest
and most effective tools you have at your disposal
to protect yourself online.