google-authenticator | Repository to integrate web sites and Google Authenticator | Addon library

I worked on setting up 2FA while doing ssh in EC2 instance. But after the setup instance is still not asking for 2FA code and directly logs my user i.e. ubuntu into the server.

I did following steps to setup 2FA:

1. Install Google Authenticator PAM module.

   sudo apt install libpam-google-authenticator

2. Add auth required pam_google_authenticator.so to /etc/pam.d/sshd

3. Restart ssh sudo systemctl restart sshd.service

4. Update sshd_config with following:

   ChallengeResponseAuthentication yes PasswordAuthentication no

5. Run command google-authenticator

Please help me resolve this issue. Thanks in advance.

We already have a single authentication process using Active Directory for our home made web sites (simple login and password). Our AD is also on Azure (everything is synchronized).

Now we want 2 factors authentification using this: (Microsoft Authenticator) https://www.microsoft.com/en-us/account/authenticator

I've been searching for an exemple for a while, but most of the tutorials I found are about MVC CORE; I'm not using core, just regular MVC .Net Framework. Furthermore, the only tutorials I found using .Net framework were for Google authenticator, not Microsoft's one.

The intended behavior would be the same as when I connect to office 365, first I enter my password in the web site, then I receive a notification on my cell phone (for exemple), by approving the connection, I can have access to web content.

I'm still trying to figure out if this is even allowed, is Microsoft Authenticator only meant to be used for Microsoft developers or can we random developers use this app for our 2FA needs? Or is there a way to trigger the office 365 authentication windows?

If yes, they don't seem eager to share any code or tutorial for MVC .net Framework. (I'm still searching)

EDIT for comments:

Microsoft auth .Net Core documentation:

https://docs.microsoft.com/en-us/aspnet/core/security/authentication/mfa?view=aspnetcore-5.0

Google auth with .Net framework documentation:

https://medium.com/@henryhdelgado/2fa-with-google-authenticator-in-asp-mvc-4788c79c47

Please help me to find out the solution.

1. Does anyone know how to write a unit test stub using PHPUnit for scanning a barcode? FYI : In our application, two-factor authentication used(google authenticator). When users enter a valid username and password next screen displayed with barcode, we scan that barcode using the google-authenticator app on mobile then 6 digit code is generated, which we enter in web application then redirects to the home page.
2. How to set a cookie while writing unit test stub for login?

I have CAS 6.2.x running in Kubernetes building the image from this repo. I am passing in the cas.properties file via configmap.I have it wired up against Active Directory and am able to login with the Username/Password. I am now working to enable MFA with the Google Authenticator plugin. I have this working as well if I force the flow globally with the following:
cas.authn.mfa.global-provider-id=mfa-gauth

When I try to use the values described here for Multifactor Authentication: Principal Attribute Trigger it doesn't send me to the MFA flow. These are the settings that I have set:
cas.authn.ldap[0].principalAttributeList=userPrincipalName,cn,givenName,sAMAccountName,memberOf
cas.authn.mfa.global-principal-attribute-name-triggers=memberOf
cas.authn.mfa.global-principal-attribute-value-regex=ForceMfa

When I log in these are the values returned back for memberOf:

memberOf
[CN=Group2,OU=MyOu,DC=subdomain,DC=domain,DC=local, CN=Group1,OU=MyOu,DC=subdomain,DC=domain,DC=local, CN=ForceMfa,OU=MyOu,DC=subdomain,DC=domain,DC=local]
Principal

I used Misagh blog post as a guide.

If I change the trigger and regex to sAMAccountName and my username it then works as expected. Not sure if I need to change the regex format to find the group name or if I just have something else wrong. It just seems like the regex is not finding a match for some reason as the settings seem to be working for me, just not with memberOf.

Thank you

I am a newbie to FreeRadius, so my knowledge is not in-depth. I am trying to configure a central radius to handle any network based systems (switches, routers, firewalls, & VPN) to authenticate end-users when they are trying to SSH and/or VPN into the system. All of my equipment supports radius.

Environment:

• OS = CentOS 7
• FreeRadius = 3.0.13
• google-authenticator-libpam = 1.09
• I did not post my config files as they are exactly covered by the reference link. I will post them in a follow-up post for ease of reading

Reference: I followed this page to get the majority of the system operational (SSLVPN Two - Factor Authentication with Google Authenticator

What is working:

• Using radtest, I can authenticate with an AD based user with their AD password+OTP
• Was able to get a network switch authenticate and access-accept reply message to include custom VSA for user group (used unlang within the post-auth area based only on the user-name). Not ideal but just for testing the concept.

Next Steps (the question): I want to be able to ultimately decide if the end-user is granted access to VPN or switch via AD security groups. So from my understanding, I could perform this within the auth module or the post-auth. I believe the correct place would be in the post-auth possible using unlang (but correct me if this is not the general area to do this). I don't know how/where I need to perform the LDAP lookup to get the user-name AD security group info. In theory, once I have the user's name & group info, these can be used in multiple filters to declare if they get access to a group of systems. Thanks

I am implementing two factor authentication with Google Authenticator in a NativeScript app starting from this implementation. Since Node's crypto module doesn't run inside NativeScript, I am trying to make it work with CryptoJS.

This is the working Node code. The function returns a buffer with the correct value.

(Solution) TL;DR: Google assumes the key string is base32 encoded; replacing any 1 with I and 0 with O. This must be decoded prior to hashing.

Original Question

I'm having difficulty having my code match up with GA. I even went chasing down counters +/- ~100,000 from the current time step and found nothing. I was very excited to see my function pass the SHA-1 tests in the RFC 6238 Appendix, however when applied to "real life" it seems to fail.

I went so far as to look at the open source code for Google Authenticator at Github (here). I used the key for testing: "qwertyuiopasdfgh". According to the Github code: