Skip to content

sshyp mfa

Jump to bottom
rwinkhart edited this page Jul 10, 2022 · 20 revisions

Installation:

Currently, sshyp-mfa is considered an experimental extension for sshyp v1.1.0+ and thus is not packaged for installation. The current intended installation model is to copy sshyp-mfa.py to your system PATH (recommended: /usr/bin/sshyp-mfa) and make it executable.

One-line installation: sudo curl -L https://raw.githubusercontent.com/rwinkhart/sshyp-labs/main/sshyp-mfa/bin/sshyp-mfa.py -o /usr/bin/sshyp-mfa; sudo chmod +x /usr/bin/sshyp-mfa

sshyp-mfa optionally depends on ValvePython/steam for Steam TOTP support. This can usually be installed with pip install -U 'steam[client]'

Usage:

sshyp-mfa is fully dependent on your sshyp password manager entries. In order to add MFA data to an existing sshyp entry, run sshyp edit -n <target entry> and add MFA data to the SECOND notes line (the second line is used to avoid the copy function copying the MFA data from the first line). MFA data is read from the Authenticator backup format, e.g.:

otpauth://<OTP METHOD>/<ACCOUNT NAME, NOT USED>?secret=<SECRET>&issuer=<ISSUER, NOT USED>&algorithm=<ALGORITHM>&digits=<DIGITS>&period=<REFRESH PERIOD>

It might be easiest to import all of your MFA keys into Authenticator, export them into plain text, then add all of the exported MFA data into the second notes line in their respective sshyp entries.

Help! What do I put in each of those spaces?

<OTP METHOD> is almost always 'totp', but in the case of Steam, it needs to be set to 'steam'.

<ACCOUNT NAME, NOT USED> is a part of the Authenticator backup format, but it is not used in sshyp-mfa. Set to anything.

<SECRET> refers to the secret used to generate your MFA key. This is usually directly provided by the issuer, but it is sometimes hidden and more easily retrieved by copying it from a QR-compatible MFA app (such as Aegis).

<ISSUER, NOT USED> is a part of the Authenticator backup format, but it is not used in sshyp-mfa. Set to anything.

<ALGORITHM> refers to the algorithm used to generate your MFA key based on your secret. This is almost always 'sha1'.

<DIGITS> refers to the intended length of your MFA key. This is almost always '6', but in the case of Steam, it needs to be set to '5'.

<REFRESH PERIOD> refers to the interval at which a new MFA key needs to be generated. This is almost always '30', for 30 seconds.

Example configuration (for most services, see above for differences regarding Steam):

otpauth://totp/MyNameIsBob?secret=YUGBSG65SG9SDBSDF56SBFVSC86SBVD6&issuer=Github&algorithm=sha1&digits=6&period=30

Clone this wiki locally