Use Two-Factor Authentication (2FA/MFA)#
Passwords and SSH keys can be stolen. Adding a one-time code keeps your server safe even if a key leaks.
Step 1: Install the PAM Module#
Install the Google Authenticator PAM package on your remote server:
sudo apt update
sudo apt install libpam-google-authenticator
Step 2: Set Up 2FA via Text (No QR Code Needed)#
Terminal QR codes often break or render poorly over remote SSH connections. Run the setup tool with flags to output plain text details instead:
google-authenticator -t -d -f -r 3 -R 30 -W
What these flags do:
-t: Use time-based tokens (TOTP).-d: Disallow reuse of the same token.-f: Force writing the configuration to~/.google_authenticator.-r 3 -R 30: Limit logins to 3 attempts every 30 seconds (rate limiting).-W: Enable window skew to allow minor clock differences.
The command outputs text similar to this:
Your new secret key is: JX7X2K3L4M5N6O7P
Your verification code is 123456
Your emergency scratch codes are:
12345678
87654321
...
- Copy the secret key and manually add it to your authenticator app.
- Save the emergency scratch codes in a secure location.
Step 3: Configure PAM for SSH#
Open the PAM configuration file:
sudo vi /etc/pam.d/sshd
Add this line at the very top of the file:
auth required pam_google_authenticator.so
Save and close the file.
Step 4: Configure the SSH Daemon#
Open your SSH configuration file:
sudo nano /etc/ssh/sshd_config
Ensure the following directives are configured:
KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
(Note: On older Ubuntu releases, use ChallengeResponseAuthentication yes instead of KbdInteractiveAuthentication yes.)
Save and close the file.
Step 5: Restart SSH and Test#
Restart the SSH daemon to apply changes:
sudo systemctl restart ssh
Warning: Do not close your current terminal window yet. Open a new terminal session to test logging in with both your SSH key and your 2FA code.