Getting Google Authenticator and Apache to Cooperate on CentOS

I love the idea of using two factor authentication to harden a web app. Recently, I discovered Google Authentication for Android, which together with the Google Authenticator platform, brings two factor authentication to The Rest Of Us.

In theory, leveraging Google Authenticator and .htpasswd should be as easy as installing the Google Authenticator Apache Module. Alas, that turns out to be much easier said then do. So, to help others out there, here's the steps I went through to lock down a directory in Apache with a one time use password from Google.

These instructions should be thought of as general road map - I'm still figuring out how the whole system works, so I apologize if I've included optional steps, or left out required ones. Where possible, I've favored specific Linux commands over explanations. If the commands bother you, you shouldn't be installing this module.

1. Grab the tools needed to compile the Apache module: yum install httpd-devel
2. Grab the Google Authenticator command line tool: yum install google-authenticator
3. Grab the source code for the Apache module: wget http://google-authenticator-apache-module.googlecode.com/files/GoogleAuthApacheModule_v01.bz2
4. CRITICAL: Grab mod_authn_google.c from this discussion. Use it replace the file found in the above download. Failing to do this will install a version of the module which prompts you for a password after a minute.
5. Update line 7 of the Makefile to have the correct install path. I changed mine to read:

   install: all
            sudo cp .libs/mod_authn_google.so /etc/httpd/modules
   

6. sudo make install
7. Create the appropriate user-dir: sudo mkdir /etc/httpd/ga_auth
8. Install Google Authenticator on your Android device and start it up.
9. Generate the Google Authenticator configuration for the user: google-authenticator
10. Notice that the first line of the Google Authenticator output is a URL that looks like: https://www.google.com/chart?chs=200x200&chld=M|.... Copy and paste that URL into a browser.
11. In the Android app, select: Menu > Scan a barcode. Point it to the QR code image shown on the screen in the previous step.
12. Store the generated Google Authenticator file where the Apache module can see it: cp ~/.google_authenticator /etc/httpd/ga_auth/foo, where foo is the user who will be logging in. Make sure the permissions are correct so the webserver can access it.
13. Update your Apache config to have a block like so:

       <Directory />
         Options FollowSymLinks ExecCGI
         AllowOverride All
         Order deny,allow
         Allow from all
    
         AuthType Basic
         AuthName "Shhhhh, secret."
         AuthBasicProvider "google_authenticator"
         Require valid-user
         GoogleAuthUserPath ga_auth
         GoogleAuthCookieLife 3600
         GoogleAuthEntryWindow 2
       </Directory>
    

14. /etc/rc.d/init.d/httpd restart
15. Watch the error log for debugging info: tail -f /var/log/htttpd/error_log
16. Point your browser to a protected directory

If all went exceedingly well, you'll be asked for a username and password. Enter the username you created in /etc/httpd/ga_auth, and use the Android app to enter the current 6 digit password.

If it doesn't work, and you see mention of "(null)" in the error log, check out this discussion.

Don't forget to run this all over SSL, or you'll be leaving a gaping security hole open.

Good luck!