Avoiding Google Authenticator Re-Authentication in Existing SSH Sessions on EC2

Avoiding Google Authenticator Re-authentication for Existing SSH Sessions on EC2

In this article, we will discuss how to avoid re-authentication with Google Authenticator when opening new SSH sessions on EC2 instances that have already been configured with 2FA. This is a common issue that arises when using Google Authenticator for securing SSH access.

Background

Google Authenticator is a popular two-factor authentication (2FA) solution that provides an additional layer of security for SSH access to EC2 instances. When configured, it requires users to provide a time-based one-time password (TOTP) generated by the Google Authenticator app, in addition to their SSH key and password.

However, a common issue that arises is that users are prompted to provide a new TOTP every time they open a new SSH session, even if they have already authenticated with Google Authenticator in a previous session. This can be frustrating and time-consuming, especially for users who frequently open and close SSH sessions.

Preventing Re-authentication for Existing SSH Sessions

To prevent re-authentication for existing SSH sessions, we can modify the SSH configuration on the EC2 instance to enable SSH agent forwarding. SSH agent forwarding allows the SSH client to forward the authentication agent connection from the local machine to the remote machine, enabling the use of the same authentication credentials for multiple SSH sessions.

Enabling SSH Agent Forwarding

To enable SSH agent forwarding, follow these steps:

1. Locate the SSH configuration file on the local machine. On Linux and macOS, this file is typically located at ~/.ssh/config.

2. Add the following line to the SSH configuration file:

   ForwardAgent yes

3. Save and close the SSH configuration file.

With SSH agent forwarding enabled, the SSH client will forward the authentication agent connection to the remote machine, allowing the use of the same authentication credentials for multiple SSH sessions.

Authenticating with Google Authenticator

After enabling SSH agent forwarding, users can authenticate with Google Authenticator for the first SSH session as usual. Once authenticated, the TOTP will be cached by the SSH agent, allowing the user to open new SSH sessions without re-authenticating with Google Authenticator.

By enabling SSH agent forwarding and caching the TOTP generated by Google Authenticator, users can avoid re-authentication for existing SSH sessions on EC2 instances. This provides a more seamless and efficient SSH experience, while still maintaining the added security provided by 2FA.

References

• How to Set Up Multi-Factor Authentication for SSH on Ubuntu 16.04

• ssh_config(5)

• SSH Keychain