Combining two-factor authentication and SSH
Setting up a secure SSH tunnel for communications and using two-factor authentication where possible are two security measures that many recommend, but what about combining the two to ensure that, if a SSH certificate key is lost or stolen, no one has illegitimate access to your server?
One group that has done just that is Authy, which has developed an API that will take care of sending and verifying tokens. Installation of the additional security measure is as simple as downloading the code to interface with its API (which the company has made available on Github); installing, enabling and testing it, then restarting the SSH service — all in about five commands.
After setting it up, users will receive tokens via SMS, or by using Authy's mobile app for Android, iPhone or BlackBerry.
