利用Google Authenticator实现用户双因素认证
2018-05-07 17:46
519 查看
一、介绍：什么是双因素认证
双因素身份认证就是通过你所知道再加上你所能拥有的这二个要素组合到一起才能发挥作用的身份认证系统。双因素认证是一种采用时间同步技术的系统，采用了基于时间、事件和密钥三变量而产生的一次性密码来代替传统的静态密码。每个动态密码卡都有一个唯一的密钥，该密钥同时存放在服务器端，每次认证时动态密码卡与服务器分别根据同样的密钥，同样的随机参数（时间、事件）和同样的算法计算了认证的动态密码，从而确保密码的一致性，从而实现了用户的认证。就像我们去银行办卡送的口令牌.
二、安装Google Authenticator
2.1 基本环境：
OS：Centos 7
IP ：192.168.150.125
2.2 所需软件：
chrony
pam-devel
qrencode－3.4.4
libpng、libpng-devel
2.3 部署
2.3.1 安装gcc等编译器，以及需要用到的库
[root@kbsonlong ~]# yum install gcc-c++ git -y
2.3.2 安装pam 开发包
[root@kbsonlong ~]# yum install pam-devel -y
2.3.3 安装chrony 软件，因为动态口令再验证时用到了时间，所以要保持时间上的一致性。简单说下chrony：chrony 是网络时间协议的（NTP）的另一种实现，与网络时间协议后台程序（ntpd）不同，它可以更快地更准确地同步系统始终。如果要使用ntp 需要单独安装。
[root@kbsonlong ~]# yum install chrony -y [root@kbsonlong ~]# vim /etc/chrony.conf … server 2.cn.pool.ntp.org iburst
重启服务并使用命令查看同步（注：202.118.1.130就是我们上一步添加的那个ntp server）
[root@kbsonlong ~]# systemctl restart chronyd [root@kbsonlong ~]# chronyc sources 210 Number of sources = 3 MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* 202.118.1.130 2 6 17 54 -58us[ +132us] +/- 85ms ^+ news.neu.edu.cn 2 6 17 54 +542us[ +732us] +/- 89ms ^- dns1.synet.edu.cn 2 6 251 46 +25ms[ +25ms] +/- 60ms
如果时区不对的话，可以拷贝你当前地区所在地的时区到系统运行的时区，如下：
cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
2.3.4 下载Google Authenticator源码
git clone https://github.com/google/google-authenticator-libpam.git
2.3.5 编译安装Google Authentication
[root@kbsonlong google-authenticator-libpam]# pwd /data/google-authenticator/google-authenticator-libpam [root@kbsonlong google-authenticator-libpam]# ll total 80 -rwxr-xr-x 1 root root 605 May 7 16:31 bootstrap.sh drwxr-xr-x 2 root root 4096 May 7 16:31 build -rw-r--r-- 1 root root 2081 May 7 16:31 configure.ac drwxr-xr-x 2 root root 4096 May 7 16:31 contrib -rw-r--r-- 1 root root 1452 May 7 16:31 CONTRIBUTING.md drwxr-xr-x 2 root root 4096 May 7 16:31 examples -rw-r--r-- 1 root root 2622 May 7 16:31 FILEFORMAT -rw-r--r-- 1 root root 11358 May 7 16:31 LICENSE -rw-r--r-- 1 root root 2340 May 7 16:31 Makefile.am drwxr-xr-x 2 root root 4096 May 7 16:31 man -rw-r--r-- 1 root root 7155 May 7 16:31 README.md drwxr-xr-x 2 root root 4096 May 7 16:31 src drwxr-xr-x 2 root root 4096 May 7 16:31 tests -rw-r--r-- 1 root root 9423 May 7 16:31 totp.html drwxr-xr-x 2 root root 4096 May 7 16:31 utc-time [root@kbsonlong google-authenticator-libpam]# ./bootstrap.sh libtoolize: putting auxiliary files in AC_CONFIG_AUX_DIR, `build'. libtoolize: copying file `build/ltmain.sh' libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `build'. libtoolize: copying file `build/libtool.m4' libtoolize: copying file `build/ltoptions.m4' libtoolize: copying file `build/ltsugar.m4' libtoolize: copying file `build/ltversion.m4' libtoolize: copying file `build/lt~obsolete.m4' configure.ac:16: installing 'build/config.guess' configure.ac:16: installing 'build/config.sub' configure.ac:13: installing 'build/install-sh' configure.ac:13: installing 'build/missing' Makefile.am: installing 'build/depcomp' parallel-tests: installing 'build/test-driver' [root@kbsonlong google-authenticator-libpam]# ./configure checking whether make supports nested variables... yes checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking minix/config.h usability... no checking minix/config.h presence... no checking for minix/config.h... no checking whether it is safe to define __EXTENSIONS__... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /usr/bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking whether to enable maintainer-specific portions of Makefiles... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking how to print strings... printf checking for a sed that does not truncate output... /usr/bin/sed checking for fgrep... /usr/bin/grep -F checking for ld used by gcc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for ar... ar checking for archiver @FILE support... @ checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc object... ok checking for sysroot... no checking for mt... no checking if : is a manifest tool... no checking for dlfcn.h... yes checking for objdir... .libs checking if gcc supports -fno-rtti -fno-exceptions... no checking for gcc option to produce PIC... -fPIC -DPIC checking if gcc PIC flag -fPIC -DPIC works... yes checking if gcc static flag -static works... no checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.o... (cached) yes checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking for gcc option to accept ISO C99... -std=gnu99 checking for gcc -std=gnu99 option to accept ISO Standard C... (cached) -std=gnu99 checking sys/fsuid.h usability... yes checking sys/fsuid.h presence... yes checking for sys/fsuid.h... yes checking for explicit_bzero... no checking for setfsuid... yes checking for security/pam_appl.h... yes checking for security/pam_modules.h... yes checking for pam_get_user in -lpam... yes checking whether certain PAM functions require const arguments... yes checking for library containing dlopen... -ldl checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating contrib/rpm.spec config.status: creating config.h config.status: executing depfiles commands config.status: executing libtool commands google-authenticator version 1.05 Prefix.........: /usr/local Debug Build....: C Compiler.....: gcc -std=gnu99 -g -O2 Linker.........: /usr/bin/ld -m elf_x86_64 -ldl [root@kbsonlong google-authenticator-libpam]# make && make install make all-am make[1]: Entering directory `/data/google-authenticator/google-authenticator-libpam' CC src/pam_google_authenticator_la-pam_google_authenticator.lo CC src/pam_google_authenticator_la-util.lo CC src/pam_google_authenticator_la-base32.lo CC src/pam_google_authenticator_la-hmac.lo CC src/pam_google_authenticator_la-sha1.lo CCLD pam_google_authenticator.la CC src/google-authenticator.o CC src/util.o CC src/base32.o CC src/hmac.o CC src/sha1.o CCLD google-authenticator make[1]: Leaving directory `/data/google-authenticator/google-authenticator-libpam' make[1]: Entering directory `/data/google-authenticator/google-authenticator-libpam' /usr/bin/mkdir -p '/usr/local/bin' /bin/sh ./libtool --mode=install /usr/bin/install -c google-authenticator '/usr/local/bin' libtool: install: /usr/bin/install -c google-authenticator /usr/local/bin/google-authenticator /usr/bin/mkdir -p '/usr/local/share/doc/google-authenticator' /usr/bin/install -c -m 644 FILEFORMAT README.md '/usr/local/share/doc/google-authenticator' /usr/bin/mkdir -p '/usr/local/share/doc/google-authenticator' /usr/bin/install -c -m 644 totp.html '/usr/local/share/doc/google-authenticator' /usr/bin/mkdir -p '/usr/local/share/man/man1' /usr/bin/install -c -m 644 man/google-authenticator.1 '/usr/local/share/man/man1' /usr/bin/mkdir -p '/usr/local/share/man/man8' /usr/bin/install -c -m 644 man/pam_google_authenticator.8 '/usr/local/share/man/man8' /usr/bin/mkdir -p '/usr/local/lib/security' /bin/sh ./libtool --mode=install /usr/bin/install -c pam_google_authenticator.la '/usr/local/lib/security' libtool: install: /usr/bin/install -c .libs/pam_google_authenticator.so /usr/local/lib/security/pam_google_authenticator.so libtool: install: /usr/bin/install -c .libs/pam_google_authenticator.lai /usr/local/lib/security/pam_google_authenticator.la libtool: finish: PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:/root/go/bin:/usr/local/go/bin:/root/bin:/sbin" ldconfig -n /usr/local/lib/security ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/security If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - add LIBDIR to the `LD_RUN_PATH' environment variable during linking - use the `-Wl,-rpath -Wl,LIBDIR' linker flag - have your system administrator add LIBDIR to `/etc/ld.so.conf' See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- make[1]: Leaving directory `/data/google-authenticator/google-authenticator-libpam'
2.3.6 安装二维码生成工具。这步✌也可以省略，如果不装的话，因为下一步生成的二维码就会成一个链接，到时将链接复制到你的浏览器中，也是可以出现二维码的，到时利用智能手机打开google author 进行扫描。
[root@kbsonlong google-authenticator]# wget -c http://fukuchi.org/works/qrencode/qrencode-3.4.4.tar.gz
--2018-05-07 16:35:22-- http://fukuchi.org/works/qrencode/qrencode-3.4.4.tar.gz
Resolving fukuchi.org (fukuchi.org)... 173.230.148.37
Connecting to fukuchi.org (fukuchi.org)|173.230.148.37|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://fukuchi.org/works/qrencode/qrencode-3.4.4.tar.gz [following]
--2018-05-07 16:35:23-- https://fukuchi.org/works/qrencode/qrencode-3.4.4.tar.gz
Connecting to fukuchi.org (fukuchi.org)|173.230.148.37|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 468788 (458K) [application/x-gzip]
Saving to: ‘qrencode-3.4.4.tar.gz’
100%[=========================================================================================================================================>] 468,788 --.-K/s in 0.05s
2018-05-07 16:35:23 (8.95 MB/s) - ‘qrencode-3.4.4.tar.gz’ saved [468788/468788]
[root@kbsonlong google-authenticator]# tar zxvf qrencode-3.4.4.tar.gz
qrencode-3.4.4/
qrencode-3.4.4/tests/
qrencode-3.4.4/tests/Makefile.am
qrencode-3.4.4/tests/test_all.sh
qrencode-3.4.4/tests/Makefile.in
qrencode-3.4.4/tests/common.h
qrencode-3.4.4/tests/decoder.c
qrencode-3.4.4/tests/decoder.h
qrencode-3.4.4/tests/create_frame_pattern.c
qrencode-3.4.4/tests/create_mqr_frame_pattern.c
qrencode-3.4.4/tests/prof_qrencode.c
qrencode-3.4.4/tests/pthread_qrencode.c
qrencode-3.4.4/tests/test_bitstream.c
qrencode-3.4.4/tests/test_estimatebit.c
qrencode-3.4.4/tests/test_mask.c
qrencode-3.4.4/tests/test_mmask.c
qrencode-3.4.4/tests/test_monkey.c
qrencode-3.4.4/tests/test_mqrspec.c
qrencode-3.4.4/tests/test_qrencode.c
qrencode-3.4.4/tests/test_qrinput.c
qrencode-3.4.4/tests/test_qrspec.c
qrencode-3.4.4/tests/test_rs.c
qrencode-3.4.4/tests/test_split.c
qrencode-3.4.4/tests/view_qrcode.c
qrencode-3.4.4/tests/frame
qrencode-3.4.4/use/
qrencode-3.4.4/use/depcomp
qrencode-3.4.4/use/compile
qrencode-3.4.4/use/config.guess
qrencode-3.4.4/use/config.rpath
qrencode-3.4.4/use/config.sub
qrencode-3.4.4/use/install-sh
qrencode-3.4.4/use/missing
qrencode-3.4.4/use/ltmain.sh
qrencode-3.4.4/Makefile.in
qrencode-3.4.4/Makefile.am
qrencode-3.4.4/configure
qrencode-3.4.4/acinclude.m4
qrencode-3.4.4/configure.ac
qrencode-3.4.4/aclocal.m4
qrencode-3.4.4/config.h.in
qrencode-3.4.4/libqrencode.pc.in
qrencode-3.4.4/qrencode.spec.in
qrencode-3.4.4/qrencode.1.in
qrencode-3.4.4/qrencode.h
qrencode-3.4.4/COPYING
qrencode-3.4.4/ChangeLog
qrencode-3.4.4/NEWS
qrencode-3.4.4/README
qrencode-3.4.4/TODO
qrencode-3.4.4/qrencode.c
qrencode-3.4.4/qrencode_inner.h
qrencode-3.4.4/qrinput.c
qrencode-3.4.4/qrinput.h
qrencode-3.4.4/bitstream.c
qrencode-3.4.4/bitstream.h
qrencode-3.4.4/qrspec.c
qrencode-3.4.4/qrspec.h
qrencode-3.4.4/rscode.c
qrencode-3.4.4/rscode.h
qrencode-3.4.4/split.c
qrencode-3.4.4/split.h
qrencode-3.4.4/mask.c
qrencode-3.4.4/mask.h
qrencode-3.4.4/mqrspec.c
qrencode-3.4.4/mqrspec.h
qrencode-3.4.4/mmask.c
qrencode-3.4.4/mmask.h
qrencode-3.4.4/qrenc.c
qrencode-3.4.4/autogen.sh
qrencode-3.4.4/qrencode.spec
qrencode-3.4.4/Doxyfile
[root@kbsonlong google-authenticator]# yum install libpng libpng-devel
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirror.scalabledns.com
* elrepo-kernel: repos.lax-noc.com
* extras: mirror.linuxfix.com
* remi-safe: mirrors.mediatemple.net
* updates: mirror.steadfast.net
Package 2:libpng-1.5.13-7.el7_2.x86_64 already installed and latest version
Package 2:libpng-devel-1.5.13-7.el7_2.x86_64 already installed and latest version
Nothing to do
[root@kbsonlong google-authenticator]# cd qrencode-3.4.4
[root@kbsonlong qrencode-3.4.4]# ./configure
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking target system type... x86_64-unknown-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for style of include used by make... GNU
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for an ANSI C-conforming const... yes
checking for inline... inline
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for gcc... (cached) gcc
checking whether we are using the GNU C compiler... (cached) yes
checking whether gcc accepts -g... (cached) yes
checking for gcc option to accept ISO C89... (cached) none needed
checking whether gcc understands -c and -o together... (cached) yes
checking dependency style of gcc... (cached) gcc3
checking how to print strings... printf
checking for a sed that does not truncate output... /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking whether the shell understands some XSI constructs... yes
checking whether the shell understands "+="... yes
checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for mt... no
checking if : is a manifest tool... no
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... no
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... no
checking for ranlib... (cached) ranlib
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking for strdup... yes
checking for pthread_mutex_init in -lpthread... yes
checking for png... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating libqrencode.pc
config.status: creating tests/Makefile
config.status: creating qrencode.spec
config.status: creating qrencode.1
config.status: creating config.h
config.status: executing depfiles commands
config.status: executing libtool commands
Options used to compile and link:
CC = gcc
CFLAGS = -Wall -g -O2
CPPFLAGS =
CXX =
CXXFLAGS =
LDFLAGS =
[root@kbsonlong qrencode-3.4.4]# make && make install
make all-recursive
make[1]: Entering directory `/data/google-authenticator/qrencode-3.4.4'
Making all in .
make[2]: Entering directory `/data/google-authenticator/qrencode-3.4.4'
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT qrencode.lo -MD -MP -MF .deps/qrencode.Tpo -c -o qrencode.lo qrencode.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT qrencode.lo -MD -MP -MF .deps/qrencode.Tpo -c qrencode.c -fPIC -DPIC -o .libs/qrencode.o
mv -f .deps/qrencode.Tpo .deps/qrencode.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT qrinput.lo -MD -MP -MF .deps/qrinput.Tpo -c -o qrinput.lo qrinput.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT qrinput.lo -MD -MP -MF .deps/qrinput.Tpo -c qrinput.c -fPIC -DPIC -o .libs/qrinput.o
mv -f .deps/qrinput.Tpo .deps/qrinput.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT bitstream.lo -MD -MP -MF .deps/bitstream.Tpo -c -o bitstream.lo bitstream.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT bitstream.lo -MD -MP -MF .deps/bitstream.Tpo -c bitstream.c -fPIC -DPIC -o .libs/bitstream.o
mv -f .deps/bitstream.Tpo .deps/bitstream.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT qrspec.lo -MD -MP -MF .deps/qrspec.Tpo -c -o qrspec.lo qrspec.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT qrspec.lo -MD -MP -MF .deps/qrspec.Tpo -c qrspec.c -fPIC -DPIC -o .libs/qrspec.o
mv -f .deps/qrspec.Tpo .deps/qrspec.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT rscode.lo -MD -MP -MF .deps/rscode.Tpo -c -o rscode.lo rscode.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT rscode.lo -MD -MP -MF .deps/rscode.Tpo -c rscode.c -fPIC -DPIC -o .libs/rscode.o
mv -f .deps/rscode.Tpo .deps/rscode.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT split.lo -MD -MP -MF .deps/split.Tpo -c -o split.lo split.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT split.lo -MD -MP -MF .deps/split.Tpo -c split.c -fPIC -DPIC -o .libs/split.o
mv -f .deps/split.Tpo .deps/split.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT mask.lo -MD -MP -MF .deps/mask.Tpo -c -o mask.lo mask.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT mask.lo -MD -MP -MF .deps/mask.Tpo -c mask.c -fPIC -DPIC -o .libs/mask.o
mv -f .deps/mask.Tpo .deps/mask.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT mqrspec.lo -MD -MP -MF .deps/mqrspec.Tpo -c -o mqrspec.lo mqrspec.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT mqrspec.lo -MD -MP -MF .deps/mqrspec.Tpo -c mqrspec.c -fPIC -DPIC -o .libs/mqrspec.o
mv -f .deps/mqrspec.Tpo .deps/mqrspec.Plo
/bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT mmask.lo -MD -MP -MF .deps/mmask.Tpo -c -o mmask.lo mmask.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -g -O2 -MT mmask.lo -MD -MP -MF .deps/mmask.Tpo -c mmask.c -fPIC -DPIC -o .libs/mmask.o
mv -f .deps/mmask.Tpo .deps/mmask.Plo
/bin/sh ./libtool --tag=CC --mode=link gcc -Wall -g -O2 -version-number 3:4:4 -o libqrencode.la -rpath /usr/local/lib qrencode.lo qrinput.lo bitstream.lo qrspec.lo rscode.lo split.lo mask.lo mqrspec.lo mmask.lo
libtool: link: gcc -shared -fPIC -DPIC .libs/qrencode.o .libs/qrinput.o .libs/bitstream.o .libs/qrspec.o .libs/rscode.o .libs/split.o .libs/mask.o .libs/mqrspec.o .libs/mmask.o -O2 -Wl,-soname -Wl,libqrencode.so.3 -o .libs/libqrencode.so.3.4.4
libtool: link: (cd ".libs" && rm -f "libqrencode.so.3" && ln -s "libqrencode.so.3.4.4" "libqrencode.so.3")
libtool: link: (cd ".libs" && rm -f "libqrencode.so" && ln -s "libqrencode.so.3.4.4" "libqrencode.so")
libtool: link: ( cd ".libs" && rm -f "libqrencode.la" && ln -s "../libqrencode.la" "libqrencode.la" )
gcc -DHAVE_CONFIG_H -I. -I/usr/include/libpng15 -Wall -g -O2 -MT qrencode-qrenc.o -MD -MP -MF .deps/qrencode-qrenc.Tpo -c -o qrencode-qrenc.o `test -f 'qrenc.c' || echo './'`qrenc.c
mv -f .deps/qrencode-qrenc.Tpo .deps/qrencode-qrenc.Po
/bin/sh ./libtool --tag=CC --mode=link gcc -I/usr/include/libpng15 -Wall -g -O2 -o qrencode qrencode-qrenc.o libqrencode.la -lpng15
libtool: link: gcc -I/usr/include/libpng15 -Wall -g -O2 -o .libs/qrencode qrencode-qrenc.o ./.libs/libqrencode.so -lpng15
make[2]: Leaving directory `/data/google-authenticator/qrencode-3.4.4'
make[1]: Leaving directory `/data/google-authenticator/qrencode-3.4.4'
Making install in .
make[1]: Entering directory `/data/google-authenticator/qrencode-3.4.4'
make[2]: Entering directory `/data/google-authenticator/qrencode-3.4.4'
/usr/bin/mkdir -p '/usr/local/lib'
/bin/sh ./libtool --mode=install /usr/bin/install -c libqrencode.la '/usr/local/lib'
libtool: install: /usr/bin/install -c .libs/libqrencode.so.3.4.4 /usr/local/lib/libqrencode.so.3.4.4
libtool: install: (cd /usr/local/lib && { ln -s -f libqrencode.so.3.4.4 libqrencode.so.3 || { rm -f libqrencode.so.3 && ln -s libqrencode.so.3.4.4 libqrencode.so.3; }; })
libtool: install: (cd /usr/local/lib && { ln -s -f libqrencode.so.3.4.4 libqrencode.so || { rm -f libqrencode.so && ln -s libqrencode.so.3.4.4 libqrencode.so; }; })
libtool: install: /usr/bin/install -c .libs/libqrencode.lai /usr/local/lib/libqrencode.la
libtool: finish: PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:/root/go/bin:/usr/local/go/bin:/root/bin:/sbin" ldconfig -n /usr/local/lib
----------------------------------------------------------------------
Libraries have been installed in:
/usr/local/lib
If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
- add LIBDIR to the `LD_LIBRARY_PATH' environment variable
during execution
- add LIBDIR to the `LD_RUN_PATH' environment variable
during linking
- use the `-Wl,-rpath -Wl,LIBDIR' linker flag
- have your system administrator add LIBDIR to `/etc/ld.so.conf'
See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
/usr/bin/mkdir -p '/usr/local/bin'
/bin/sh ./libtool --mode=install /usr/bin/install -c qrencode '/usr/local/bin'
libtool: install: /usr/bin/install -c .libs/qrencode /usr/local/bin/qrencode
/usr/bin/mkdir -p '/usr/local/include'
/usr/bin/install -c -m 644 qrencode.h '/usr/local/include'
/usr/bin/mkdir -p '/usr/local/share/man/man1'
/usr/bin/install -c -m 644 qrencode.1 '/usr/local/share/man/man1'
/usr/bin/mkdir -p '/usr/local/lib/pkgconfig'
/usr/bin/install -c -m 644 libqrencode.pc '/usr/local/lib/pkgconfig'
make[2]: Leaving directory `/data/google-authenticator/qrencode-3.4.4'
make[1]: Leaving directory `/data/google-authenticator/qrencode-3.4.4'
[root@kbsonlong qrencode-3.4.4]# google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@kbsonlong%3Fsecret%3DOESKRCPFBHVX4QNLJ6J65MWTR4%26issuer%3Dkbsonlong
Your new secret key is: OESKRCPFBHVX4QNLJ6J65MWTR4
Your verification code is 170906
Your emergency scratch codes are:
71500218
28529324
55227626
10866708
44540819
Do you want me to update your "/root/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
[root@kbsonlong qrencode-3.4.4]# more /root/.google_authenticator
OESKRCPFBHVX4QNLJ6J65MWTR4
" RATE_LIMIT 3 30
" WINDOW_SIZE 17
" DISALLOW_REUSE
" TOTP_AUTH
71500218
28529324
55227626
10866708
44540819
[root@kbsonlong qrencode-3.4.4]#三、open***、ssh配置Google Authenticator
3.1 配置ssh
[root@kbsonlong ~]# vim /etc/pam.d/sshd auth required pam_google_authenticator.so no_increment_hotp
配置sshd服务，/etc/ssh/sshd_config，主要修改以下3个值：
[root@kbsonlong ~]# vim /etc/ssh/sshd_config ... PasswordAuthentication yes ChallengeResponseAuthentication yes UsePAM yes
注意：这里插一条错误记录,测试过程中出现的。
[root@kbsonlong ~]# tail -40f /var/log/secure .... May 7 16:43:01 kbsonlong sshd[33414]: PAM unable to dlopen(/usr/lib64/security/pam_google_authenticator.so): /usr/lib64/security/pam_google_authenticator.so: cannot open shared object file: No such file or directory May 7 16:43:01 kbsonlong sshd[33414]: PAM adding faulty module: /usr/lib64/security/pam_google_authenticator.so May 7 16:43:03 kbsonlong sshd[33416]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
修改方法：创建软链接即可，必须创建，或者直接复制过去也可。
[root@kbsonlong ~]# ln -s /usr/local/lib/security/pam_google_authenticator.so /usr/lib64/security/pam_google_authenticator.so
之后，重启sshd 服务
[root@kbsonlong ~]# systemctl restart sshd
测试登录
[root@kbsonlong ~]# ssh test@192.168.150.125 Verification code: Password: Last failed login: Mon May 7 17:35:55 CST 2018 from hadoop1 on ssh:notty There was 1 failed login attempt since the last successful login. Last login: Mon May 7 17:33:13 2018 [test@kbsonlong ~]$
使用xshell等工具登录需要修改登录方式
登录提示输入验证码
验证码通过后提示输入密码
3.2 配置open***
/etc/pam.d/open*** 这个配置文件是真正认证 open*** 登录的配置文件，里面内容主要是以下几句： auth required pam_google_authenticator.so nullok forward_pass debug account required pam_unix.so
第一行的 forward_pass 参数使得一次读入 google authenticator 的密码，然后把密码扔给后续的pam处理
debug 参数完全是调试的需要，生产环境可以不用
第二行是必须的，否则 open*** 登录不上
3.3 用户初始化
因为 google authenticator 需要在每个用户的家目录里生成一个叫 .google_authenticator 的文件，里面存有密钥和几个一次性的超级认证码及其他一些配置，所以，我们需要在 open*** 服务器上做一次初始化数据的工作。假设有 10个用户要用这个系统登录 open***、ssh，用户名从 user1 到 user10，那么初始化脚本就是：
for i in {1..10}
do
useradd user${i}
su -c \
"google-authenticator -t -f -d -w 17 -r 3 -R 30 -q" \
user${i}
cat /home/user${i}/.google_authenticator | \
mail -s "your .google_authenticator is:" \
user${i}@xxx.com
done这里注意，在用户数据初始化的最后部分，将生成的 .google_authenticator 发给了每个用户自己。
四、优化
4.1 不足之处
上面的环境即使在内网还是需要二次认证；所以这个好解决，将允许本地局域网直接登录系统。
4.2 解决内网主机跳过二次认证
编辑pam.d下的sshd 文件，在第一行增加内容，主要是指定允许的主机信息文件，如下所示：
[root@kbsonlong ~]# more -2 /etc/pam.d/sshd auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-localhost.conf auth required pam_google_authenticator.so no_increment_hotp
然后在/etc/security/目录下创建access-localhost.conf文件，并添加内容如下：
[root@kbsonlong ~]# cat /etc/security/access-localhost.conf # skipped local network for google auth... + : ALL : 192.168.150.0/24 + : ALL : LOCAL - : ALL : ALL
最后，重启sshd 服务
[root@kbsonlong ~]# systemctl restart sshd
4.3 测试，内网主机登陆便直接使用密钥登陆了。
sk:~ kbsonlong$ ssh root@192.168.150.125 Password: Last login: Sun May 07 17:21:46 2018 from 192.168.150.101
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- 利用Django内置的认证视图实现用户密码重置功能详解
- 利用servlet 实现JAVAWeb访问微信OAuth2.0认证，获取用户信息的实例
- 利用NTLM 验证整合Squid及Samba3实现Win2k3域用户认证
- 利用servlet 实现JAVAWeb访问微信OAuth2.0认证，获取用户信息的实例
- 利用ACS服务器实现用户的认证、授权和审计
- PHP中对用户身份认证实现两种方法
- 利用mmap实现用户空间与内核空间的共享内存通信
- 利用SQLSERVER存储过程实现ASP用户身份验证
- 简单的Struts2的Interceptors(拦截器)机制介绍以及利用拦截器实现用户登陆时执行耗时操作并自动跳转的实例
- Spring Shiro配置实现用户认证和授权
- 利用HttpModuler实现WEB程序同一时间只让一个用户实例登陆
- 利用okhttp框架实现包含验证码的用户登录，保持session操作
- （微信公众号开发《一》OAuth2.0网页授权认证获取用户的详细信息，实现自动登陆）http://blog.csdn.net/liaohaojian/article/details/70175835
- 利用HttpModuler实现 WEB程序同一时间只让一个用户 登陆
- asp.net core利用DI实现自定义用户系统，脱离ControllerBase.User
- 多功能复合机基于用户认证功能的实现过程详解 推荐
- 利用BIND的VIEW功能实现国内国处用户解析到不同服务器的智能解析
- Python利用pyHook实现监听用户鼠标与键盘事件
- 利用CSVDE命令实现域用户账户的批量添加示例
- Debian系统下利用vsdftpd+Mysql实现虚拟用户登录（Debian+vsftpd+Mysql）