Can port forward before entering authy token

[lawrencedudley]

If you do ssh -L 4000:google.com:80 user@remotehost -i key.pem you get prompted for the authy key but can access google.com on localhost:4000 before entering it.

Seems like an issue?

[DoramGreenblat]

The SSH Daemon hook authy uses only comes into play via script after successful ssh session opened, by that point, ssh is available.

I can take this issue one step further, add a -N flag to the ssh command.
This will open a no console ssh session with only reverse tunnel and will not prompt for authy logins, yet tunnel will remain 100% active.

In order for real 2 factor authentication, a PAM module would be needed (which is how google authenticator and DUO get around this problem)

[syrnick]

This is really a big issue. Any progress?

Until you have a solution, please add a big warning to the Readme about this hole.

[GervaisdeM]

I opened a ticket around this issue and the fact that a user's ~/.bash_profile can have commands in it that run before authy kicks in. Apparently, a fix is in the works, but is months away.

For now, I enable both ssk keys and passwords in my sshd_config. This a simple 2FA.

CentOS7

• add the line AuthenticationMethods "publickey,password" "publickey,keyboard-interactive"

CentOS6

• add RequiredAuthentications2 publickey,password

Source: http://security.stackexchange.com/questions/17931/possible-to-use-both-private-key-and-password-authentication-for-ssh-login/26211#26211