一般大家都是使用账号和密码远程SSH登录管理服务器。但SSH账号和密码很容易泄露，或者经常遭遇暴力破解。咨询过前同事赛赛，他们目前使用了谷歌身份验证器。查看了谷歌身份验证器的github和其它网上文档，重新整理归纳。
谷歌身份验证器生成的是动态验证码，默认30秒更新。修改配置，SSH登录必须在输入密码之前输入动态验证码。即使账号和密码泄露，验证码输入错误，仍然无法登录。苹果或者安卓手机端可以安装身份验证器App读取验证码。
1.禁用并关闭selinux
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/configsetenforce 0
2.安装依赖软件包
yum -y install gcc make pam-devel libpng-devel libtool wget git
3.添加阿里云epel源
-
RHEL 6/CentOS 6系列
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-6.repo
-
RHEL 7/CentOS 7系列
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
4.安装Qrencode，谷歌身份验证器需要调用该程序以便终端生成并显示二维码
yum -y install qrencode
5.安装谷歌身份验证器
mkdir -p /App/srccd /App/srcgit clone https://github.com/google/google-authenticator.gitcd google-authenticator/libpam/./bootstrap.sh./configuremakemake installcp /usr/local/lib/security/pam_google_authenticator.so /lib64/security/
6./etc/pam.d/sshd第一行后添加谷歌身份验证器PAM模块配置
auth required pam_google_authenticator.so
7.修改SSH服务配置/etc/ssh/sshd_config
sed -i 's#^ChallengeResponseAuthentication no#ChallengeResponseAuthentication yes#' /etc/ssh/sshd_config
8.重启SSH服务
-
RHEL 6/CentOS 6系列
service sshd restart
-
RHEL 7/CentOS 7系列
systemctl restart sshd.service
9.终端切换至需要二次验证的系统用户后运行验证器程序google-authenticator，遇到(y/n)可以都输入y，为需要远程SSH登录的每个用户生成动态口令
Do you want authentication tokens to be time-based (y/n) y https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/songsong@localhost.localdomain%3Fsecret%3DX3PYDDGPI4BF3DMIVTZ33IRQI4%26issuer%3Dlocalhost.localdomain 二维码 Your new secret key is: X3PYDDGPI4BF3DMIVTZ33IRQI4 Your verification code is 318806 Your emergency scratch codes are: 34181847 33327793 54307163 36901756 21117069 Do you want me to update your "/home/songsong/.google_authenticator" file (y/n) y Do you want to disallow multiple uses of the same authentication token? This restricts you to one login about every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) Do you want to disallow multiple uses of the same authentication token? This restricts you to one login about every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) y By default, tokens are good for 30 seconds. In order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. If you experience problems with poor time synchronization, you can increase the window from its default size of +-1min (window size of 3) to about +-4min (window size of 17 acceptable tokens). Do you want to do so? (y/n) y If the computer that you are logging into isn't hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting (y/n) y
10.苹果手机打开App Store搜索Google Authenticator，安卓手机打开应用商店搜索身份验证器，安装对应App
-
苹果手机
-
安卓
11.手机打开安装的App后点击开始设置，而后点击扫描条形码，扫描终端显示的二维码
12.修改SecureCRT的连接属性，右键选择已有主机连接的Properties，在新弹窗点选SSH2，将Authentication选项中的Keyboard Interactive顺序调整至首行 
终端运行验证器程序google-authenticator内容说明：
Do you want authentication tokens to be time-based (y/n)
输入y基于时间方式生成验证口令，输入n使用计数器方式生成验证口令。
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/songsong@localhost.localdomain%3Fsecret%3DX3PYDDGPI4BF3DMIVTZ33IRQI4%26issuer%3Dlocalhost.localdomain
显示二维码的网页地址，需要设法能够访问到谷歌，方法你懂得。
二维码
若未安装Qrencode，则不会显示二维码。
Your new secret key is: X3PYDDGPI4BF3DMIVTZ33IRQI4
若未显示二维码，谷歌二维码页面地址亦无法访问，java教程则手机端身份验证器App可以使用输入提供的秘钥，符号:之后的内容即为生成的秘钥。
Your verification code is 318806
临时生成的6位数字验证码，默认30秒到期。
Your emergency scratch codes are: 34181847 33327793 54307163 36901756 21117069
生成的5组应急备用验证码，每个验证码只能使用一次，使用后立即失效。当多次使用手机App端显示的验证码无效时使用，保存备用。
注意事项：
若使用默认基于时间方式生成动态口令，确保安装谷歌身份验证器的服务器和手机系统时间一致，否则无法登录系统。所以服务器和手机系统定期同步公网公开的时间服务器，这样可以确保两者时间一致。