Changes between Version 2 and Version 3 of GoogleAuthenticator

Timestamp:

06/20/11 16:36:39 (13 years ago)

Author:

mshore2@…

Comment:

--

GoogleAuthenticator

@@ -20 +20 @@
 
 1. Download source from code.google.com using the instructions at [[http://code.google.com/p/google-authenticator/source/checkout]]
-1. cd into the google-authenticator/libpam directory
-1. type "make"
-1. run it locally to make sure that it built correct.  When it asks if you want to update your "~/.google_authenticator" file, type "n". Note that if you do not see a QR barcode on your screen, libqrencode-dev is not installed.  The interaction should look something like this:
+2. cd into the google-authenticator/libpam directory
+3. type "make"
+4. run it locally to make sure that it built correct.  When it asks if you want to update your "~/.google_authenticator" file, type "n". Note that if you do not see a QR barcode on your screen, libqrencode-dev is not installed.  The interaction should look something like this:
 [[Image(Screenshot-sxmls@google-authenticator.png)]]
 5. If it looks healthy, get your secret key provisioned and available to your phone and to your Linux account.  I'm describing the process on an Android phone because that's what I've got.  (Someone may want to add instructions for iPhone or Blackberry):
@@ -34 +34 @@
    1. The last question is whether or not you'd like to limit login attempts to 3 every 30 seconds.  This is to protect against brute-force attacks, in which the attacker tries every value in the space until it gets a match.  Since there are only 1,000,000 possible codes, on average one can be found in only 500,000 guesses.  Since guessing involves absolutely no computation to speak of (integer increment by one is a machine instruction), it's a very good idea to enable rate-limiting here.
  1. now, verify that it's actually working by running the demo program in the source directory.  When it asks for your Verification code:, type in the six-digit number provided by the Google Authenticator app on your phone.  If it's successful it says nothing and returns you to the prompt.  If it's not successful it prints "Login failed  Invalid verification code"
-
- 
-1 If it looks healthy, with root privileges type "make install".  This will install the pam module in /lib/security and the "google-authenticator" executable in /usr/local/bin.
+6. If it still looks healthy, with root privileges type "make install".  This will install the pam module in /lib/security and the "google-authenticator" executable in /usr/local/bin.
+7. You're now ready to configure pam to use Google authenticator as a second auth factor (never, '''ever''' use it as a single authentication mechanism)