Implement two-factor authentication for SSH with Google Authenticator and TOTP

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Global variables
BACKUP_DIR="/tmp/ssh-2fa-backup-$(date +%s)"
CLEANUP_NEEDED=false

# Print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Usage message
usage() {
    echo "Usage: $0 [--user USERNAME] [--auth-method key|password]"
    echo ""
    echo "Options:"
    echo "  --user USERNAME        Setup 2FA for specific user (default: current user)"
    echo "  --auth-method METHOD   Authentication method: 'key' or 'password' (default: key)"
    echo ""
    echo "Example:"
    echo "  $0 --user alice --auth-method key"
    exit 1
}

# Cleanup function for rollback
cleanup() {
    if [ "$CLEANUP_NEEDED" = true ] && [ -d "$BACKUP_DIR" ]; then
        print_warning "Rolling back changes..."
        [ -f "$BACKUP_DIR/sshd_config" ] && cp "$BACKUP_DIR/sshd_config" /etc/ssh/sshd_config
        [ -f "$BACKUP_DIR/sshd_pam" ] && cp "$BACKUP_DIR/sshd_pam" /etc/pam.d/sshd
        systemctl restart sshd || true
        print_warning "Rollback completed. Backup files are in: $BACKUP_DIR"
    fi
}

# Set trap for cleanup on error
trap cleanup ERR

# Check if running as root or with sudo
check_privileges() {
    if [ "$EUID" -ne 0 ]; then
        print_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Detect distribution and package manager
detect_distro() {
    if [ ! -f /etc/os-release ]; then
        print_error "/etc/os-release not found. Cannot detect distribution."
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            PKG_UPGRADE="apt upgrade -y"
            GA_PACKAGE="libpam-google-authenticator"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf update -y"
            GA_PACKAGE="google-authenticator"
            # Enable EPEL for older versions
            if ! dnf repolist | grep -q epel; then
                dnf install -y epel-release || true
            fi
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf update -y"
            GA_PACKAGE="google-authenticator"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum check-update || true"
            PKG_INSTALL="yum install -y"
            PKG_UPGRADE="yum update -y"
            GA_PACKAGE="google-authenticator"
            yum install -y epel-release || true
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
}

# Parse command line arguments
parse_args() {
    TARGET_USER=""
    AUTH_METHOD="key"
    
    while [[ $# -gt 0 ]]; do
        case $1 in
            --user)
                TARGET_USER="$2"
                shift 2
                ;;
            --auth-method)
                AUTH_METHOD="$2"
                if [[ "$AUTH_METHOD" != "key" && "$AUTH_METHOD" != "password" ]]; then
                    print_error "Invalid auth method. Use 'key' or 'password'"
                    usage
                fi
                shift 2
                ;;
            -h|--help)
                usage
                ;;
            *)
                print_error "Unknown option: $1"
                usage
                ;;
        esac
    done
    
    # If no user specified, use SUDO_USER or current user
    if [ -z "$TARGET_USER" ]; then
        TARGET_USER="${SUDO_USER:-$(whoami)}"
    fi
    
    # Validate user exists
    if ! id "$TARGET_USER" &>/dev/null; then
        print_error "User '$TARGET_USER' does not exist"
        exit 1
    fi
}

# Create backup directory
create_backup() {
    mkdir -p "$BACKUP_DIR"
    chmod 700 "$BACKUP_DIR"
    CLEANUP_NEEDED=true
    
    # Backup SSH configuration files
    cp /etc/ssh/sshd_config "$BACKUP_DIR/sshd_config"
    cp /etc/pam.d/sshd "$BACKUP_DIR/sshd_pam"
    
    print_status "Configuration backed up to: $BACKUP_DIR"
}

# Main installation steps
main() {
    parse_args "$@"
    check_privileges
    detect_distro
    create_backup
    
    print_status "[1/8] Updating system packages..."
    $PKG_UPDATE
    $PKG_UPGRADE
    
    print_status "[2/8] Installing Google Authenticator PAM module..."
    $PKG_INSTALL $GA_PACKAGE qrencode
    
    print_status "[3/8] Configuring PAM for SSH authentication..."
    if ! grep -q "pam_google_authenticator.so" /etc/pam.d/sshd; then
        sed -i '1i auth required pam_google_authenticator.so' /etc/pam.d/sshd
    fi
    
    print_status "[4/8] Configuring SSH daemon for 2FA..."
    # Enable required SSH settings
    sed -i 's/^#*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
    sed -i 's/^#*UsePAM.*/UsePAM yes/' /etc/ssh/sshd_config
    
    # Set authentication method based on user choice
    if [ "$AUTH_METHOD" = "key" ]; then
        if grep -q "^AuthenticationMethods" /etc/ssh/sshd_config; then
            sed -i 's/^AuthenticationMethods.*/AuthenticationMethods publickey,keyboard-interactive/' /etc/ssh/sshd_config
        else
            echo "AuthenticationMethods publickey,keyboard-interactive" >> /etc/ssh/sshd_config
        fi
    else
        if grep -q "^AuthenticationMethods" /etc/ssh/sshd_config; then
            sed -i 's/^AuthenticationMethods.*/AuthenticationMethods password,keyboard-interactive/' /etc/ssh/sshd_config
        else
            echo "AuthenticationMethods password,keyboard-interactive" >> /etc/ssh/sshd_config
        fi
        sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
    fi
    
    print_status "[5/8] Testing SSH configuration..."
    if ! sshd -t; then
        print_error "SSH configuration test failed"
        exit 1
    fi
    
    print_status "[6/8] Restarting SSH service..."
    systemctl restart sshd
    systemctl status sshd --no-pager -l
    
    print_status "[7/8] Setting up Google Authenticator for user: $TARGET_USER..."
    USER_HOME=$(getent passwd "$TARGET_USER" | cut -d: -f6)
    
    print_warning "Switching to user '$TARGET_USER' to configure Google Authenticator..."
    print_warning "Please answer the prompts as follows:"
    echo "  - Time-based tokens: y"
    echo "  - Update file: y" 
    echo "  - Disallow multiple uses: y"
    echo "  - Increase window: n"
    echo "  - Rate limiting: y"
    echo ""
    print_warning "IMPORTANT: Save the emergency scratch codes shown!"
    echo ""
    
    # Run google-authenticator as the target user
    su - "$TARGET_USER" -c 'google-authenticator'
    
    # Ensure proper permissions on the authenticator file
    if [ -f "$USER_HOME/.google_authenticator" ]; then
        chown "$TARGET_USER:$TARGET_USER" "$USER_HOME/.google_authenticator"
        chmod 400 "$USER_HOME/.google_authenticator"
    fi
    
    print_status "[8/8] Verifying configuration..."
    
    # Verify SSH daemon configuration
    echo "SSH Configuration:"
    sshd -T | grep -E 'challengeresponseauthentication|authenticationmethods|usepam|passwordauthentication' || true
    echo ""
    
    # Verify PAM configuration
    echo "PAM Configuration:"
    grep google_authenticator /etc/pam.d/sshd || print_warning "Google Authenticator not found in PAM config"
    echo ""
    
    # Verify user's 2FA file
    if [ -f "$USER_HOME/.google_authenticator" ]; then
        print_status "2FA file created successfully for user: $TARGET_USER"
    else
        print_warning "2FA file not found. User may need to run 'google-authenticator' manually"
    fi
    
    print_status "SSH Two-Factor Authentication setup completed successfully!"
    echo ""
    print_warning "IMPORTANT NEXT STEPS:"
    echo "1. Keep this SSH session open as backup"
    echo "2. Test SSH 2FA login from another terminal/machine"
    echo "3. You will need both your SSH key/password AND the 6-digit code from your authenticator app"
    echo "4. Emergency scratch codes are your backup if you lose your phone"
    echo ""
    print_warning "Test command: ssh $TARGET_USER@$(hostname -I | awk '{print $1}')"
    
    # Don't cleanup on success
    CLEANUP_NEEDED=false
}

main "$@"