fix grammar in 2022 posts

1 files changed, 34 insertions, 35 deletions

diff --git a/content/blog/2022-03-26-ssh-mfa.org b/content/blog/2022-03-26-ssh-mfa.org
index dd9a5ac..0236aa4 100644
--- a/content/blog/2022-03-26-ssh-mfa.org
+++ b/content/blog/2022-03-26-ssh-mfa.org
@@ -3,31 +3,29 @@
 #+description: Step-by-step deployment guide for enabling TOTP multi-factor authentication on SSH services using Google Authenticator and Pluggable Authentication Module (PAM) integration.
 #+slug:        ssh-mfa
 
-* Why Do I Need MFA for SSH?
+* Why Do I Need Multi-Factor Authentication (MFA) for SSH (Secure Shell Protocol)?
 
-If you are a sysadmin of a server anywhere (that includes at home!), you
-may want an added layer of protection against intruders. This is not a
-replacement for other security measures, such as:
+If you are a sysadmin of a server anywhere (that includes at home!), you may
+want an added layer of protection against intruders. This is not a replacement
+for other security measures, such as:
 
 - Disable root SSH
 - Disable SSH password authentication
 - Allow only certain users to login via SSH
-- Allow SSH only from certain IPs
+- Allow SSH only from certain internet protocol (IP) addressess
 
-However, MFA can be added as an additional security measure to ensure
-that your server is protected. This is especially important if you need
-to allow password authentication for SSH.
+However, MFA can be added as an additional security measure to ensure that your
+server is protected. This is especially important if you need to allow password
+authentication for SSH.
 
-For more guidance on server security measures, see my other post:
-[[../hardening-a-public-facing-home-server/][Hardening a Public-Facing
-Home Server]].
+For more guidance on server security measures, see my other post: [[https://cleberg.net/blog/server-hardening.html][Step-by-Step
+Guide to Securing Your Home Server with Firewalls, SSH, and VLANs]].
 
 * Install MFA PAM Module
 
-PAM, which stands for Pluggable Authentication Module, is an
-authentication infrastructure used on Linux systems to authenticate a
-user. In order to use this technology, let's install the
-=libpam-google-authenticator= package:
+PAM (Pluggable Authentication Module) is an authentication infrastructure used
+on Linux systems to authenticate a user. In order to use this technology, let's
+install the =libpam-google-authenticator= package:
 
 #+begin_src sh
 sudo apt-get update
@@ -41,16 +39,17 @@ sudo apt-get install libpam-google-authenticator
 
 ** Interactive Method
 
-Once the package is installed, initialize it and following the
-interactive prompts to generate your OTP or TOTP:
+Once the package is installed, initialize it and following the interactive
+prompts to generate your OTP (One-Time Password) or TOTP (Time-based One-Time
+Password):
 
 #+begin_src sh
 google-authenticator
 #+end_src
 
-If you are not sure how to answer, read the prompts carefully and think
-about having to how each situation would affect your normal login
-attempts. If you are still not sure, use my default responses below.
+If you are not sure how to answer, read the prompts carefully and think about
+having to how each situation would affect your normal login attempts. If you are
+still not sure, use my default responses below.
 
 #+begin_src txt
 OUTPUT
@@ -58,8 +57,8 @@ OUTPUT
 Do you want authentication tokens to be time-based (y/n) y
 #+end_src
 
-At this point, use an authenticator app somewhere one of your devices to
-scan the QR code. Any future login attempts after our upcoming
+At this point, use an authenticator app somewhere one of your devices to scan
+the QR (quick-response) code. Any future login attempts after our upcoming
 configuration changes will require that TOTP.
 
 #+begin_src txt
@@ -134,23 +133,23 @@ google-authenticator [<options>]
  -e, --emergency-codes=N        Number of emergency codes to generate
 #+end_src
 
-This fully configures the authenticator, saves it to a file, and then
-outputs the secret key, QR code, and recovery codes. (If you add the
-flag =-q=, then there won't be any output). If you use this command in
-an automated fashion, make sure your script captures the secret key
-and/or recovery codes and makes them available to the user.
+This fully configures the authenticator, saves it to a file, and then outputs
+the secret key, QR code, and recovery codes. (If you add the flag =-q=, then
+there won't be any output). If you use this command in an automated fashion,
+make sure your script captures the secret key and/or recovery codes and makes
+them available to the user.
 
 * PAM Configuration Settings
 
-Once you've enabled the T/OTP and have it saved to an MFA app on your
-phone or other device, open the PAM =sshd= file:
+Once you've enabled MFA and have it saved to an MFA app on your phone or other
+device, open the PAM =sshd= file:
 
 #+begin_src sh
 sudo nano /etc/pam.d/sshd
 #+end_src
 
-You need to do two things in this file. First, add the following lines
-to the bottom of the file:
+You need to do two things in this file. First, add the following lines to the
+bottom of the file:
 
 #+begin_src config
 auth required pam_google_authenticator.so nullok
@@ -159,8 +158,8 @@ auth required pam_permit.so
 
 Second, comment-out the following line near the top of the file.
 
-If you leave this line uncommented, every SSH login attempt will ask for
-the following three authentication factors:
+If you leave this line uncommented, every SSH login attempt will ask for the
+following three authentication factors:
 
 1. Publickey
 2. Password
@@ -178,8 +177,8 @@ Finally, edit the =sshd_config= file again:
 sudo nano /etc/ssh/sshd_config
 #+end_src
 
-You'll need to change =ChallengeResponseAuthentication= to yes and add
-the =AuthenticationMethods= line to the bottom of the file.
+You'll need to change =ChallengeResponseAuthentication= to yes and add the
+=AuthenticationMethods= line to the bottom of the file.
 
 #+begin_src config
 ChallengeResponseAuthentication yes