Passwörter und 2FA

sudo apt install libpam-pwquality

sudo nano /etc/security/pwquality.conf

# Minimum password length
minlen = 12

# Minimum number of character classes (uppercase, lowercase, digits, special characters)
minclass = 3

# Minimum number of uppercase letters
ucredit = -1

# Minimum number of lowercase letters
lcredit = -1

# Minimum number of digits
dcredit = -1

# Minimum number of special characters
ocredit = -1

# Number of characters that must differ from the old password
difok = 5

# Prevent using the username as part of the password
usercheck = 1

# Limit consecutive identical characters
maxrepeat = 3

# Limit consecutive characters of the same class
maxclassrepeat = 4

# Reject palindrome passwords
palindrome = 1

# Reject common dictionary words
dictcheck = 1

# Edit global settings
sudo nano /etc/login.defs

# Maximum password age (days)
PASS_MAX_DAYS   90

# Minimum password age (days)
PASS_MIN_DAYS   7

# Password expiration warning days
PASS_WARN_AGE   14

# Minimum password length
PASS_MIN_LEN    12

# Set maximum password age to 90 days
sudo chage -M 90 username
 
# Set minimum password age to 7 days
sudo chage -m 7 username
 
# Set 14-day expiration warning
sudo chage -W 14 username
 
# Immediately require password change
sudo chage -d 0 username
 
# View user password policy
sudo chage -l username

sudo nano /etc/pam.d/common-password

password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=12

# Install
sudo apt install pass
 
# Initialize (requires a GPG key)
gpg --gen-key
pass init "your-gpg-id"
 
# Add a password
pass insert email/gmail
pass insert -m server/production    # multi-line mode
 
# View a password
pass email/gmail
 
# Generate a random password
pass generate web/newsite 20
 
# List all passwords
pass ls
 
# Search
pass find gmail

# Install
sudo apt install keepassxc
 
# Or use snap
sudo snap install keepassxc

# Install the PAM module
sudo apt install libpam-google-authenticator
 
# Run initialization as a regular user
google-authenticator

Do you want authentication tokens to be time-based (y/n) y
# Choose y for time-based tokens (TOTP)

# A QR code will be displayed -- scan it with an authenticator app
# Recommended apps: Google Authenticator, Authy, Microsoft Authenticator, FreeOTP

Do you want me to update your "/home/user/.google_authenticator" file? (y/n) y

Do you want to disallow multiple uses of the same authentication token? (y/n) y
# Choose y to prevent token replay

By default, a new token is generated every 30 seconds.
Do you want to change the size of the time skew window? (y/n) n

Do you want to enable rate-limiting? (y/n) y
# Choose y to limit attempt frequency

sudo nano /etc/pam.d/common-auth

auth required pam_google_authenticator.so nullok

# Edit PAM SSH configuration
sudo nano /etc/pam.d/sshd

auth required pam_google_authenticator.so

sudo nano /etc/ssh/sshd_config

# Enable keyboard-interactive authentication
KbdInteractiveAuthentication yes

# Require key + TOTP dual authentication
AuthenticationMethods publickey,keyboard-interactive

sudo systemctl restart ssh

sudo nano /etc/pam.d/sudo

auth required pam_google_authenticator.so

# Install the PAM U2F module
sudo apt install libpam-u2f
 
# Install management tools
sudo apt install pamu2fcfg

# Create configuration directory
mkdir -p ~/.config/Yubico
 
# Register the first key (insert the security key and touch it)
pamu2fcfg > ~/.config/Yubico/u2f_keys
 
# Register a backup key (append mode)
pamu2fcfg -n >> ~/.config/Yubico/u2f_keys

sudo nano /etc/pam.d/sudo

auth sufficient pam_u2f.so

sudo nano /etc/pam.d/gdm-password

auth required pam_u2f.so

# Generate a FIDO2 SSH key
ssh-keygen -t ed25519-sk -C "your_email@example.com"
 
# Or use a resident key (does not require the corresponding hardware key for the public key in .ssh/authorized_keys on the server)
ssh-keygen -t ed25519-sk -O resident -C "your_email@example.com"
 
# Deploy the public key to the server
ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub user@server

# /etc/pam.d/common-auth
auth required pam_unix.so
auth required pam_google_authenticator.so

auth required pam_unix.so
auth sufficient pam_u2f.so
auth required pam_google_authenticator.so

sudo nano /etc/pam.d/common-auth

auth required pam_faillock.so preauth silent deny=5 unlock_time=900
auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900

sudo nano /etc/pam.d/common-account

account required pam_faillock.so

# View a user's failed attempts
sudo faillock --user username
 
# Unlock a user
sudo faillock --user username --reset
 
# View all locked users
sudo faillock