Two Factor Authentication

[Peter_APIIT]

Dear All,

How to implement Two Factor Authentication into su command ? Thanks.

[jggimi]

For access to the root account, two-factor authentication is already mandatory in order to use su(1).

1. Be authenticated by successfully logging in to an account in the wheel group.
2. Know the root password.

System accounts such as those used by daemons do not have passwords, so that su(1) cannot be used to obtain their credentials.

For end-user accounts, such as those used by you or your users, these require only a single factor authentication: knowledge of the account's password.

But that is only if an end-user account has a password, used for local login. An account used for remote login via SSH may use other authentication mechanisms, and does not require a password. If remote end-user accounts are established without passwords, su(1) could not be used to authenticate as those users.

[Peter_APIIT]

Thanks for the informative explanation.

Questions:
How to disable any users add to wheel group and nobody can edit the /etc/group file? (systrace perhaps)

[sacerdos_daemonis]

Perhaps I misunderstand the question, but editing files in the /etc directory requires the root password. So it should not be necessary to remove that ability from users. If you have given users sudo privileges, they should only have root access to whatever you allow.

I have a feeling I am missing something in the question. If so, please elaborate.

[jggimi]

I think Peter is unclear about the authority granted to a standard user, compared with the authority of the super user.

Peter, the wheel group is just like any other group -- used for filesystem access control -- except that it one of the two factors for root user authorization access with su(1).

Let's look at the specific file where wheel group access is defined: /etc/group. According to group(5), group memberships are defined here.

Groups are used to define access controls to filesystems. And, for su(1), membership in the wheel group is needed for root user access.

There are three layers of access control for any file, or any directory. user, group, and world. Let's look at one file, for example. /etc/group. Here's mine:

4 -rw-r--r--  1 root  wheel  1266 Jun 12 23:44 /etc/group

The "root wheel" tells me that the file is owned by the user root, and assigned to the group wheel.

The "-rw-r-r--" is the access granted to the user, to the assigned group, and to the world, which is all other users. The file is readable and writeable by the user root, readable by other users who are in the group wheel, and also readable by any other users on this system.

The root user is the superuser, and access to all files is granted to root regardless of ownership or group assignment.

[Peter_APIIT]

Thanks. From your opinion and experience, granted access as superuser with su or sudo. Which one has far better than the other (Lock down access) ?

[ocicat]

Originally Posted by Peter_APIIT

Which one has far better than the other (Lock down access) ?

sudo(8).

[jggimi]

Sudo. I'd recommended it to jkl three days ago here, which you must have missed. But even better, today ocicat very clearly compared su and sudo. I'll quote his post directly out of that thread, because I think it is both better and clearer than what I had to say. He and I both recommended the same book.

Originally Posted by ocicat

su(1) implements an either-or scheme -- either one has the administrative password, or one does not, and if one has knowledge of the password, one has access to everything.

Keeping the password secret also becomes harder as more administrators are needed. Plus, this creates more instances where the password can be compromised.

sudo(8) implements a scheme where knowledge of the administrative password is not required, and administrative work can divided between many, & each has access to only what they need -- not everything.

While this sounds bureaucratic in how to manage a staff, sudo(8) simplifies administrative tasks of single-user systems too.

The real value of sudo(8) is how an administrative policy can be flexibly constructed for large and small systems alike.

Readers are encouraged to read Michael Lucas' book on this very topic:

https://www.michaelwlucas.com/nonfiction/sudo-mastery

Highly recommended.