|
0
|
1 #
|
|
|
2 # based on http://blog.boa.nu/2012/11/two-factor-ssh-login-google-authenticator-and-selinux.html
|
|
|
3 #
|
|
|
4
|
|
|
5 r := $(shell grep Wrote: mylog | grep -v debuginfo | awk '{print $$2}')
|
|
|
6 b := $(shell basename ${r})
|
|
|
7 m := google-authenticator.pp
|
|
|
8
|
|
|
9 all:
|
|
1
|
10 yum -y install pam-devel selinux-policy-devel
|
|
0
|
11 rpmbuild --rebuild google-authenticator-1.0-0.gita096a62.fc24.6.src.rpm >mylog 2>&1
|
|
|
12 grep Wrote: mylog
|
|
|
13 make -f /usr/share/selinux/devel/Makefile
|
|
|
14
|
|
|
15 install:
|
|
|
16 [ -f ${r} ] || /bin/false
|
|
|
17 yum -y install ${r}
|
|
|
18 semodule -i ${m}
|
|
|
19 sed -i -e 's/PAM-1.0/PAM-1.0\nauth required pam_google_authenticator.so nullok/g' /etc/pam.d/sshd
|
|
|
20 sed -i -e 's/^ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' /etc/ssh/sshd_config
|
|
|
21 service sshd restart
|
|
|
22
|
|
1
|
23 install-centos7:
|
|
|
24 [ -f ${r} ] || /bin/false
|
|
|
25 yum -y install ${r}
|
|
|
26 sed -i -e 's/PAM-1.0/PAM-1.0\nauth required pam_google_authenticator.so nullok/g' /etc/pam.d/sshd
|
|
|
27 sed -i -e 's/^ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' /etc/ssh/sshd_config
|
|
|
28 systemctl restart sshd.service
|
|
0
|
29
|
|
|
30 setup:
|
|
|
31 google-authenticator
|
|
|
32 # authenticator setup creates the file with the wrong label.
|
|
|
33 restorecon ~/.google_authenticator
|
|
|
34
|
|
|
35
|
|
|
36 install-remote:
|
|
|
37 scp ${r} ${m} $$target:/tmp
|
|
|
38 ssh $$target "cd /tmp; yum -y install ${b}"
|
|
|
39 ssh $$target "cd /tmp; semodule -i ${m}"
|
|
|
40 ssh $$target "sed -i -e 's/PAM-1.0/PAM-1.0\nauth required pam_google_authenticator.so nullok/g' /etc/pam.d/sshd"
|
|
|
41 ssh $$target "sed -i -e 's/^ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' /etc/ssh/sshd_config"
|
|
|
42 ssh $$target "service sshd restart"
|
|
|
43
|
|
|
44 # make install-remote target=host.domain.tld
|
