SecureShell/MFA - Revision history

Mbaney at 20:38, 11 September 2025

2025-09-11T20:38:09Z

← Older revision		Revision as of 20:38, 11 September 2025
Line 11:		Line 11:

	==Example==		==Example==
	The initial command or session setup for connecting to a host with multi-factor authentication enabled over SSH is the same as one that does not have it enabled. Our example for connecting to a host over SSH can be found [[SecureShell#Connecting_to_an_SSH_Server \| here]]. In the below example, we are also SSH-ing to a [[Nexus]] node e.g. <code>ssh username@~~nexusgroup00~~.umiacs.umd.edu</code>		The initial command or session setup for connecting to a host with multi-factor authentication enabled over SSH is the same as one that does not have it enabled. Our example for connecting to a host over SSH can be found [[SecureShell#Connecting_to_an_SSH_Server \| here]]. In the below example, we are also SSH-ing to a [[Nexus]] node e.g. <code>ssh username@nexusgroup.umiacs.umd.edu</code>

	Once you enter the command (if using a native terminal) or start the session (PuTTY or other terminal emulators), you will be presented with the following prompt:		Once you enter the command (if using a native terminal) or start the session (PuTTY or other terminal emulators), you will be presented with the following prompt:
Line 79:		Line 79:
	</pre>		</pre>

	Subsequent SSH attempts from the window you have already connected ~~via~~ will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because ~~at this point~~ the point of origin for the network traffic behind the connection attempt is coming from within ~~the~~ UMIACS border, rather than the rest of the ~~Internet~~.		Subsequent SSH attempts from the window you have already connected to will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because the point of origin for the network traffic behind the connection attempt is now coming from within UMIACS' network border, rather than the rest of the internet.
	<pre>		<pre>
	[username@nexusgroup00 ~]$ ssh nexusgroup01.umiacs.umd.edu		[username@nexusgroup00 ~]$ ssh nexusgroup01.umiacs.umd.edu

Mbaney at 16:58, 18 July 2025

2025-07-18T16:58:22Z

← Older revision		Revision as of 16:58, 18 July 2025
Line 8:		Line 8:
	* 129.2.30.0/26		* 129.2.30.0/26

	SSH has two different authentication methods that we currently support on all of our internal hosts: interactive password authentication and [[SSH/Keys \| public key authentication]]. Multi-factor authentication-enabled SSH on our public-facing hosts only supports interactive password authentication, with the secondary factor coming from ~~our [~~[Duo]~~] instance~~. We do not ~~currently~~ support public key based authentication and [[Duo]] multi-factor authentication on our public-facing hosts. Please note that unfortunately [https://en.wikipedia.org/wiki/Universal_2nd_Factor U2F] hardware tokens registered with Duo are not supported for SSH login specifically. Other hardware tokens such as a [https://www.yubico.com/products/yubikey-5-overview/ YubiKey] or [https://guide.duo.com/tokens Duo's own hardware token] will still work.		SSH has two different authentication methods that we currently support on all of our internal hosts: interactive password authentication and [[SSH/Keys \| public key authentication]]. Multi-factor authentication-enabled SSH on our public-facing hosts only supports interactive password authentication, with the secondary factor coming from [https://it.umd.edu/multi-factor-authentication-mfa UMD's Duo instance]. We do not support public key based authentication and Duo multi-factor authentication on our public-facing hosts. Please note that unfortunately [https://en.wikipedia.org/wiki/Universal_2nd_Factor U2F] hardware tokens registered with Duo are not supported for SSH login specifically. Other hardware tokens such as a [https://www.yubico.com/products/yubikey-5-overview/ YubiKey] or [https://guide.duo.com/tokens Duo's own hardware token] will still work.

	==Example==		==Example==
Line 19:		Line 19:
	</pre>		</pre>

	Enter your UMD passphrase here (the same as if you were using interactive password authentication to connect to an internal host). After correctly entering your password, you will be taken to the following prompt. '''Please note: The options shown here will vary depending on what/how many devices you have registered with ~~our~~ Duo instance.''' In this example, we have a mobile phone ~~that has~~ the Duo app installed~~, a tablet (iPad) that has the Duo app installed, a Duo hardware token, and a YubiKey all registered against our UMIACS Duo instance~~.		Enter your UMD passphrase here (the same as if you were using interactive password authentication to connect to an internal host). After correctly entering your password, you will be taken to the following prompt. '''Please note: The options shown here will vary depending on what/how many devices you have registered with UMD's Duo instance.''' In this example, we just have a single mobile phone with an active phone number and the Duo Mobile app installed.

	<pre>		<pre>
Line 28:		Line 28:

	1. Duo Push to XXX-XXX-1234		1. Duo Push to XXX-XXX-1234
	2~~. Duo Push to iPad (iOS)~~		2. Phone call to XXX-XXX-1234
	3. Phone call ~~to XXX-XXX-1234~~
	~~4. SMS passcodes~~ to XXX-XXX-1234

	Passcode or option (1-4):		Passcode or option (1-2):
	</pre>		</pre>
	(if you have a registered phone, the last 4 digits shown will be replaced with the last 4 digits of the phone number you specifically have registered)		(if you have a registered phone, the last 4 digits shown will be replaced with the last 4 digits of the phone number you specifically have registered)

	The numbered options here correspond to different methods that Duo can take to authenticate you, and are more or less identical to the options that would be presented to you via a GUI if you were attempting to sign into ~~another of our multi-factor authentication secured services, such as our [https://intranet~~.~~umiacs.umd.edu/directory/auth/login Directory application]. You can also enter the passcode~~		The numbered options here correspond to different methods that Duo can take to authenticate you, and are more or less identical to the options that would be presented to you via a GUI if you were attempting to sign into UMD's Duo elsewhere.

	===Duo Push to ___===		===Duo Push to ___===
Line 42:		Line 40:

	<pre>		<pre>
	Passcode or option (1-4): 1		Passcode or option (1-2): 1

	Pushed a login request to your device...		Pushed a login request to your device...
Line 51:		Line 49:

	<pre>		<pre>
	Passcode or option (1-4): 3		Passcode or option (1-2): 2

	Calling your phone...		Calling your phone...
Line 61:		Line 59:
	<pre>Answered. Press any key on your phone to log in.</pre>		<pre>Answered. Press any key on your phone to log in.</pre>

	===~~SMS passcodes to XXX-XXX-XXXX===~~		===Tap YubiKey===
	This will send a one time passcode to your registered phone via SMS and then redisplay the prompt. Type the passcode received at the new prompt (which will show the first number of the passcode sent as a hint) to proceed.		In addition, you can also simply tap the sensor on your YubiKey plugged into the device you are using to SSH to have it emit a string of characters and automatically hit Enter.
	~~<pre>~~
	~~Passcode or option (1-4): 4~~

	~~New SMS passcodes sent.~~

	~~Duo two-factor login for username~~

	~~Enter a passcode or select one of the following options:~~

	~~1. Duo Push to XXX-XXX-1234~~
	~~2. Duo Push to iPad (iOS)~~
	~~3. Phone call to XXX-XXX-1234~~
	~~4. SMS passcodes to XXX-XXX-1234 (next code starts with: 1)~~

	~~Passcode or option (1-4): 1234567~~
	~~</pre>~~

	~~===Enter passcode or tap~~ YubiKey===
	In addition, you can also ~~enter the code shown in your Duo app for UMIACS, the code shown on a registered hardware token, or tap your YubiKey to emit a code:~~

	~~====Code shown in Duo app or hardware token====~~
	~~[[File:Duo_app_code.jpg]]~~

	~~(if in the Duo app)~~

	~~<pre>~~
	~~Enter a passcode or select one of the following options:~~

	~~1. Duo Push to XXX-XXX-1234~~
	~~2. Duo Push to iPad (iOS)~~
	~~3. Phone call to XXX-XXX-1234~~
	~~4. SMS passcodes to XXX-XXX-1234~~

	~~Passcode or option (1-4): 672239~~
	~~</pre>~~

	~~[[File:Duo_token.png]]~~

	~~(if using a hardware token)~~

	~~<pre>~~
	~~Enter a passcode or select one of the following options:~~

	~~1. Duo Push to XXX-XXX-1234~~
	~~2. Duo Push to iPad (iOS)~~
	~~3. Phone call to XXX-XXX-1234~~
	~~4. SMS passcodes to XXX-XXX-1234~~

	~~Passcode or option (1-4): 123456~~
	~~</pre>~~

	~~====YubiKey tap====~~
	~~Simply~~ tap the sensor on your YubiKey plugged into the device you are using to SSH to have it emit a string of characters and automatically hit Enter.

	<pre>		<pre>
Line 121:		Line 66:

	1. Duo Push to XXX-XXX-1234		1. Duo Push to XXX-XXX-1234
	2~~. Duo Push to iPad (iOS)~~		2. Phone call to XXX-XXX-1234
	3. Phone call ~~to XXX-XXX-1234~~
	~~4. SMS passcodes~~ to XXX-XXX-1234

	Passcode or option (1-4): kffuastenhldrhfhadafdarivuntddugrvjvllddjjuget		Passcode or option (1-2): kffuastenhldrhfhadafdarivuntddugrvjvllddjjuget
	</pre>		</pre>

Mbaney at 17:11, 30 June 2025

2025-06-30T17:11:44Z

← Older revision		Revision as of 17:11, 30 June 2025
Line 19:		Line 19:
	</pre>		</pre>

	Enter your ~~UMIACS password~~ here (the same as if you were using interactive password authentication to connect to an internal host). After correctly entering your password, you will be taken to the following prompt. '''Please note: The options shown here will vary depending on what/how many devices you have registered with our Duo instance.''' In this example, we have a mobile phone that has the Duo app installed, a tablet (iPad) that has the Duo app installed, a Duo hardware token, and a YubiKey all registered against our UMIACS Duo instance.		Enter your UMD passphrase here (the same as if you were using interactive password authentication to connect to an internal host). After correctly entering your password, you will be taken to the following prompt. '''Please note: The options shown here will vary depending on what/how many devices you have registered with our Duo instance.''' In this example, we have a mobile phone that has the Duo app installed, a tablet (iPad) that has the Duo app installed, a Duo hardware token, and a YubiKey all registered against our UMIACS Duo instance.

	<pre>		<pre>

Mbaney: /* Considerations */

2025-02-18T20:58:23Z

Considerations

← Older revision		Revision as of 20:58, 18 February 2025
Line 145:		Line 145:

	==Considerations==		==Considerations==
	Since there is now an additional step to log in to our public-facing hosts ~~if not using our [[VPN]]~~, we would recommend first establishing a connection over our VPN if you anticipate needing to SSH to several different hosts or need to open several different terminal windows concurrently. As mentioned previously, you do not need an additional multi-factor authentication step when using ~~SSH if you first connect to our VPN since it is already secured by multi-factor authentication.~~		Since there is now an additional step to log in to our public-facing hosts, we would recommend using a [https://en.wikipedia.org/wiki/Terminal_multiplexer terminal multiplexer] such as [[Screen]] or [[Tmux]] to minimize the number of times you need to multi-factor authenticate. Terminal multiplexers allow you to start several different processes out of one terminal display, and also detach from and later reattach to each of the processes.

	~~An alternative would be to use~~ a [https://en.wikipedia.org/wiki/Terminal_multiplexer terminal multiplexer] such as [[Screen]] or [[Tmux]] to minimize the number of times you need to multi-factor authenticate. Terminal multiplexers allow you to start several different processes out of one terminal display, and also detach from and later reattach to each of the processes.

Mbaney at 20:57, 18 February 2025

2025-02-18T20:57:27Z

← Older revision		Revision as of 20:57, 18 February 2025
Line 1:		Line 1:
	==Overview==		==Overview==
	UMIACS has rolled out multi-factor authentication requirements when using [[SSH]] to connect to our ~~public~~-~~facing~~ hosts to provide better account and data security. ~~Public~~-~~facing~~ hosts are hosts that ~~are reachable via~~ the ~~Internet (e.g. via~~ [https://en.wikipedia.org/wiki/~~Ping_(networking_utility) ping]) without first establishing a connection to our [[VPN]~~]. ~~'''If you first connect to our VPN, you will not need to additionally multi-factor authenticate when using SSH~~.''' This is because our VPN already requires multi-factor authentication to establish a connection, and all subsequent SSH attempts after connecting to our VPN will pass through the tunnel created (already within the UMIACS border).		UMIACS has rolled out multi-factor authentication requirements when using [[SSH]] to connect to our publicly-routable hosts to provide better account and data security. Publicly-routable hosts in the context of UMIACS are hosts that have an IP address in one of the following [https://en.wikipedia.org/wiki/Subnet subnets]:
			* 128.8.118.0/23
			* 128.8.120.0/23
			* 128.8.122.0/24
			* 128.8.124.0/24
			* 128.8.141.0/24
			* 129.2.30.0/26

	SSH has two different authentication methods that we currently support on all of our internal hosts: interactive password authentication and [[SSH/Keys \| public key authentication]]. Multi-factor authentication-enabled SSH on our public-facing hosts only supports interactive password authentication, with the secondary factor coming from our [[Duo]] instance. We do not currently support public key based authentication and [[Duo]] multi-factor authentication on our public-facing hosts. Please note that unfortunately [https://en.wikipedia.org/wiki/Universal_2nd_Factor U2F] hardware tokens registered with Duo are not supported for SSH login specifically. Other hardware tokens such as a [https://www.yubico.com/products/yubikey-5-overview/ YubiKey] or [https://guide.duo.com/tokens Duo's own hardware token] will still work.		SSH has two different authentication methods that we currently support on all of our internal hosts: interactive password authentication and [[SSH/Keys \| public key authentication]]. Multi-factor authentication-enabled SSH on our public-facing hosts only supports interactive password authentication, with the secondary factor coming from our [[Duo]] instance. We do not currently support public key based authentication and [[Duo]] multi-factor authentication on our public-facing hosts. Please note that unfortunately [https://en.wikipedia.org/wiki/Universal_2nd_Factor U2F] hardware tokens registered with Duo are not supported for SSH login specifically. Other hardware tokens such as a [https://www.yubico.com/products/yubikey-5-overview/ YubiKey] or [https://guide.duo.com/tokens Duo's own hardware token] will still work.

Mbaney: /* Considerations */

2024-01-08T14:51:06Z

Considerations

← Older revision		Revision as of 14:51, 8 January 2024
Line 141:		Line 141:
	Since there is now an additional step to log in to our public-facing hosts if not using our [[VPN]], we would recommend first establishing a connection over our VPN if you anticipate needing to SSH to several different hosts or need to open several different terminal windows concurrently. As mentioned previously, you do not need an additional multi-factor authentication step when using SSH if you first connect to our VPN since it is already secured by multi-factor authentication.		Since there is now an additional step to log in to our public-facing hosts if not using our [[VPN]], we would recommend first establishing a connection over our VPN if you anticipate needing to SSH to several different hosts or need to open several different terminal windows concurrently. As mentioned previously, you do not need an additional multi-factor authentication step when using SSH if you first connect to our VPN since it is already secured by multi-factor authentication.

	An alternative would be to use a [https://en.wikipedia.org/wiki/Terminal_multiplexer terminal multiplexer] such as [[Screen]] ~~(on [[RHEL7]])~~ or [[Tmux]] ~~(on RHEL8+, also available in our [[Modules \| module tree]] on RHEL7)~~ to minimize the number of times you need to multi-factor authenticate. Terminal multiplexers allow you to start several different processes out of one terminal display, and also detach from and later reattach to each of the processes.		An alternative would be to use a [https://en.wikipedia.org/wiki/Terminal_multiplexer terminal multiplexer] such as [[Screen]] or [[Tmux]] to minimize the number of times you need to multi-factor authenticate. Terminal multiplexers allow you to start several different processes out of one terminal display, and also detach from and later reattach to each of the processes.

Mbaney at 20:06, 6 November 2023

2023-11-06T20:06:26Z

← Older revision		Revision as of 20:06, 6 November 2023
Line 5:		Line 5:

	==Example==		==Example==
	The initial command or session setup for connecting to a host with multi-factor authentication enabled over SSH is the same as one that does not have it enabled. Our example for connecting to a host over SSH can be found [[SecureShell#Connecting_to_an_SSH_Server \| here]]. In the below example, we are also SSH-ing to a [[Nexus]] node e.g. <code>ssh username@~~nexuscbcb00~~.umiacs.umd.edu</code>		The initial command or session setup for connecting to a host with multi-factor authentication enabled over SSH is the same as one that does not have it enabled. Our example for connecting to a host over SSH can be found [[SecureShell#Connecting_to_an_SSH_Server \| here]]. In the below example, we are also SSH-ing to a [[Nexus]] node e.g. <code>ssh username@nexusgroup00.umiacs.umd.edu</code>

	Once you enter the command (if using a native terminal) or start the session (PuTTY or other terminal emulators), you will be presented with the following prompt:		Once you enter the command (if using a native terminal) or start the session (PuTTY or other terminal emulators), you will be presented with the following prompt:
Line 127:		Line 127:
	Success. Logging you in...		Success. Logging you in...
	Last login: Wed Feb 17 12:00:00 2021 from ...		Last login: Wed Feb 17 12:00:00 2021 from ...
	[username@~~nexuscbcb00~~ ~]$		[username@nexusgroup00 ~]$
	</pre>		</pre>

	Subsequent SSH attempts from the window you have already connected via will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because at this point the point of origin for the network traffic behind the connection attempt is coming from within the UMIACS border, rather than the rest of the Internet.		Subsequent SSH attempts from the window you have already connected via will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because at this point the point of origin for the network traffic behind the connection attempt is coming from within the UMIACS border, rather than the rest of the Internet.
	<pre>		<pre>
	[username@~~nexuscbcb00~~ ~]$ ssh ~~cbcbsub00~~.umiacs.umd.edu		[username@nexusgroup00 ~]$ ssh nexusgroup01.umiacs.umd.edu
	username@~~cbcbsub00~~.umiacs.umd.edu's password:		username@nexusgroup01.umiacs.umd.edu's password:
	Last login: Wed Feb 17 11:59:00 2021 from ...		Last login: Wed Feb 17 11:59:00 2021 from ...
	[username@~~nexuscbcb00~~ ~]$		[username@nexusgroup01 ~]$
	</pre>		</pre>

Mbaney at 16:14, 25 May 2023

2023-05-25T16:14:16Z

← Older revision		Revision as of 16:14, 25 May 2023
Line 5:		Line 5:

	==Example==		==Example==
	The initial command or session setup for connecting to a host with multi-factor authentication enabled over SSH is the same as one that does not have it enabled. Our example for connecting to a host over SSH can be found [[SecureShell#Connecting_to_an_SSH_Server \| here]]. In the below example, we are also SSH-ing to a [[Nexus]] node e.g. <code>ssh username@~~nexusclip00~~.umiacs.umd.edu</code>		The initial command or session setup for connecting to a host with multi-factor authentication enabled over SSH is the same as one that does not have it enabled. Our example for connecting to a host over SSH can be found [[SecureShell#Connecting_to_an_SSH_Server \| here]]. In the below example, we are also SSH-ing to a [[Nexus]] node e.g. <code>ssh username@nexuscbcb00.umiacs.umd.edu</code>

	Once you enter the command (if using a native terminal) or start the session (PuTTY or other terminal emulators), you will be presented with the following prompt:		Once you enter the command (if using a native terminal) or start the session (PuTTY or other terminal emulators), you will be presented with the following prompt:
Line 127:		Line 127:
	Success. Logging you in...		Success. Logging you in...
	Last login: Wed Feb 17 12:00:00 2021 from ...		Last login: Wed Feb 17 12:00:00 2021 from ...
	[username@~~nexusclip00~~ ~]$		[username@nexuscbcb00 ~]$
	</pre>		</pre>

	Subsequent SSH attempts from the window you have already connected via will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because at this point the point of origin for the network traffic behind the connection attempt is coming from within the UMIACS border, rather than the rest of the Internet.		Subsequent SSH attempts from the window you have already connected via will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because at this point the point of origin for the network traffic behind the connection attempt is coming from within the UMIACS border, rather than the rest of the Internet.
	<pre>		<pre>
	[username@~~nexusclip00~~ ~]$ ssh cbcbsub00.umiacs.umd.edu		[username@nexuscbcb00 ~]$ ssh cbcbsub00.umiacs.umd.edu
	username@cbcbsub00.umiacs.umd.edu's password:		username@cbcbsub00.umiacs.umd.edu's password:
	Last login: Wed Feb 17 11:59:00 2021 from ...		Last login: Wed Feb 17 11:59:00 2021 from ...
	[username@~~nexusclip00~~ ~]$		[username@nexuscbcb00 ~]$
	</pre>		</pre>

Mbaney: /* Considerations */

2022-09-21T19:34:55Z

Considerations

← Older revision		Revision as of 19:34, 21 September 2022
Line 139:		Line 139:

	==Considerations==		==Considerations==
	Since there ~~will~~ now be an additional step to log in to our public-facing hosts if not using our [[VPN]], we would recommend first establishing a connection over our VPN if you anticipate needing to SSH to several different hosts or need to open several different terminal windows concurrently. As mentioned previously, you ~~will~~ not need an additional multi-factor authentication step when using SSH if you first connect to our VPN since it is already secured by multi-factor authentication.		Since there is now an additional step to log in to our public-facing hosts if not using our [[VPN]], we would recommend first establishing a connection over our VPN if you anticipate needing to SSH to several different hosts or need to open several different terminal windows concurrently. As mentioned previously, you do not need an additional multi-factor authentication step when using SSH if you first connect to our VPN since it is already secured by multi-factor authentication.

	An alternative would be to use a [https://en.wikipedia.org/wiki/Terminal_multiplexer terminal multiplexer] such as [[Screen]] (on [[RHEL7]]) or [[Tmux]] (on RHEL8+, also available in our [[Modules \| module tree]] on RHEL7) to minimize the number of times you need to multi-factor authenticate. Terminal multiplexers allow you to start several different processes out of one terminal display, and also detach from and later reattach to each of the processes.		An alternative would be to use a [https://en.wikipedia.org/wiki/Terminal_multiplexer terminal multiplexer] such as [[Screen]] (on [[RHEL7]]) or [[Tmux]] (on RHEL8+, also available in our [[Modules \| module tree]] on RHEL7) to minimize the number of times you need to multi-factor authenticate. Terminal multiplexers allow you to start several different processes out of one terminal display, and also detach from and later reattach to each of the processes.

Mbaney: /* Wrapping up */

2022-09-21T19:34:25Z

Wrapping up

← Older revision		Revision as of 19:34, 21 September 2022
Line 127:		Line 127:
	Success. Logging you in...		Success. Logging you in...
	Last login: Wed Feb 17 12:00:00 2021 from ...		Last login: Wed Feb 17 12:00:00 2021 from ...
	[username@~~nexusclip01~~ ~]$		[username@nexusclip00 ~]$
	</pre>		</pre>

	Subsequent SSH attempts from the window you have already connected via will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because at this point the point of origin for the network traffic behind the connection attempt is coming from within the UMIACS border, rather than the rest of the Internet.		Subsequent SSH attempts from the window you have already connected via will not require multi-factor authentication, even if the host you are trying to SSH to is another public-facing host. This is because at this point the point of origin for the network traffic behind the connection attempt is coming from within the UMIACS border, rather than the rest of the Internet.
	<pre>		<pre>
	[username@~~nexusclip01~~ ~]$ ssh cbcbsub00.umiacs.umd.edu		[username@nexusclip00 ~]$ ssh cbcbsub00.umiacs.umd.edu
	username@cbcbsub00.umiacs.umd.edu's password:		username@cbcbsub00.umiacs.umd.edu's password:
	Last login: Wed Feb 17 11:59:00 2021 from ...		Last login: Wed Feb 17 11:59:00 2021 from ...
	[username@~~nexusclip01~~ ~]$		[username@nexusclip00 ~]$
	</pre>		</pre>