News for hackers. Stuff that matters.

A comment on Simple Two-Factor SSH Authentication.

Re:Simple Two-Factor SSH Authentication by js4all on Saturday September 24, 2011 @06:09AM (#3032928)
What a great solution. I will use it, but...

I guess I found a serious security problem.

When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.

[ Parent | on HN ]
Re:Simple Two-Factor SSH Authentication by moomerman on Saturday September 24, 2011 @01:03PM (#3033681)
I don't see the secret in the output when I run that command. It just says:

debug1: Remote: Forced command.

[ Parent | on HN ]
Re:Simple Two-Factor SSH Authentication by moomerman on Saturday September 24, 2011 @01:16PM (#3033726)
It seems that certain versions of OpenSSH do print out the command and parameters so I've updated the blog post to include a work-around
[ Parent | on HN ]