Two-Factor Authentication

Use Two-Factor Authentication (2FA/MFA)

#

Passwords and SSH keys can be stolen. Adding a one-time code keeps your server safe even if a key leaks.

Step 1: Install the PAM Module

#

Install the Google Authenticator PAM package on your remote server:

sudo apt update
sudo apt install libpam-google-authenticator

Step 2: Set Up 2FA via Text (No QR Code Needed)

#

Terminal QR codes often break or render poorly over remote SSH connections. Run the setup tool with flags to output plain text details instead:

google-authenticator -t -d -f -r 3 -R 30 -W

What these flags do:

• -t: Use time-based tokens (TOTP).
• -d: Disallow reuse of the same token.
• -f: Force writing the configuration to ~/.google_authenticator.
• -r 3 -R 30: Limit logins to 3 attempts every 30 seconds (rate limiting).
• -W: Enable window skew to allow minor clock differences.

The command outputs text similar to this:

Your new secret key is: JX7X2K3L4M5N6O7P
Your verification code is 123456
Your emergency scratch codes are:
  12345678
  87654321
  ...

1. Copy the secret key and manually add it to your authenticator app.
2. Save the emergency scratch codes in a secure location.

Step 3: Configure PAM for SSH

#

Open the PAM configuration file:

sudo vi /etc/pam.d/sshd

Add this line at the very top of the file:

auth required pam_google_authenticator.so

Save and close the file.

Step 4: Configure the SSH Daemon

#

Open your SSH configuration file:

sudo nano /etc/ssh/sshd_config

Ensure the following directives are configured:

KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

(Note: On older Ubuntu releases, use ChallengeResponseAuthentication yes instead of KbdInteractiveAuthentication yes.)

Save and close the file.

Step 5: Restart SSH and Test

#

Restart the SSH daemon to apply changes:

sudo systemctl restart ssh

Warning: Do not close your current terminal window yet. Open a new terminal session to test logging in with both your SSH key and your 2FA code.

Links

#

• Hardening SSH Access on Ubuntu VPS