为 Linux 服务器 SSH 添加 TOTP 动态验证码以及 Java 实现算法 - 全球主机交流论坛

Do you want authentication tokens to be time-based
需要启用基于时间的认证吗？
Do you want me to update your "/root/.google_authenticator" file?
需要更新配置文件吗？
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks ?
禁止多次使用同一个身份验证令牌吗？这将限制大约每 30 秒登录一次，它将减少中间人攻击的机会
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so?
默认情况下，移动应用程序每 30 秒生成一个新令牌。
为了补偿客户端和服务器之间可能的时间偏差，
我们允许在当前时间之前和之后一个额外的令牌。这允许一个
身份验证服务器和客户端之间的时间偏差最大为 30 秒。如果你
遇到时间同步不好的问题，可以增加窗口
从其默认大小的 3 个允许代码（一个以前的代码，当前的
代码，下一个代码）到 17 个允许的代码（前 8 个代码，当前代码
代码，以及接下来的 8 个代码）。这将允许最多 4 分钟的时间偏差
客户端和服务器之间。
要这样做吗？
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting?
如果您登录的计算机没有针对蛮力进行强化
登录尝试，您可以为身份验证模块启用速率限制。
默认情况下，这会将攻击者限制为每 30 秒不超过 3 次登录尝试。
您要启用速率限制吗？

复制代码