Centos上安装Google Authenticator

相关工具安装

yum install -y qrencode # 想要在终端里面显示二维码（可选）

yum install google-authenticator -y

# 基本配置，切换到需要使用动态口令的用户下面

PS:下面会生成5个紧急验证码(当无法获取动态验证码或验证码不能使用时可以使用这5个)，这5个验证码用一个就会少一个！请保存好！

执行 google-authenticator


Do you want me to update your "~/.google_authenticator" file (y/n) y

# 您是否希望不允许多次使用相同的身份验证令牌?这限制了你每30秒只能登录一次，但是它增加了你注意到甚至防止中间人攻击的机会
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

# 默认情况下，令牌的有效时间为30秒，为了补偿客户端和服务器之间可能的时间偏差，我们允许在当前时间之前和之后使用额外的令牌。
如果您遇到时间同步不足的问题，您可以将窗口的默认大小从1:30分钟增加到大约4min。你想这样做
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y

# 如果正在登录的计算机没有对强制登录尝试进行增强，那么可以为身份验证模块启用速率限制。默认情况下，这限制了攻击者每30秒登录尝试不超过3次。是否要启用速率限制

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y

基本配置文件修改

# 修改登陆认证模块加载 /etc/pam.d/sshd 添加如下内容，到如下地方。

auth required pam_google_authenticator.so