How to set up two-factor authentication - Revision history

Scott: /* Public Key + 2FA */

2026-02-13T22:12:33Z

Public Key + 2FA

← Older revision		Revision as of 22:12, 13 February 2026
Line 57:		Line 57:
	AuthenticationMethods publickey,keyboard-interactive		AuthenticationMethods publickey,keyboard-interactive
	</pre>		</pre>
			(skip the <code>Match User</code> line if everyone needs to use 2FA)
	Restart sshd:		Restart sshd:
	<pre>		<pre>
	sudo systemctl restart sshd.service		sudo systemctl restart sshd.service
	</pre>		</pre>





			Note: this won't affect password-use for sudo commands.

2026-02-13T22:10:18Z

Configure SSH

← Older revision		Revision as of 22:10, 13 February 2026
Line 20:		Line 20:
	auth required pam_google_authenticator.so nullok		auth required pam_google_authenticator.so nullok
	</pre>		</pre>
	(skip "nullok" if ALL users must use 2FA)		(skip <code>nullok</code> if ALL users must use 2FA)
	Edit <code>/etc/ssh/sshd_config</code>. Look for <code>ChallengeResponseAuthentication</code> OR <code>KbdInteractiveAuthentication</code> and set its value to <code>yes</code>:		Edit <code>/etc/ssh/sshd_config</code>. Look for <code>ChallengeResponseAuthentication</code> OR <code>KbdInteractiveAuthentication</code> and set its value to <code>yes</code>:
	<pre>		<pre>

2026-02-13T22:09:33Z

Configure SSH

← Older revision		Revision as of 22:09, 13 February 2026
Line 20:		Line 20:
	auth required pam_google_authenticator.so nullok		auth required pam_google_authenticator.so nullok
	</pre>		</pre>
			(skip "nullok" if ALL users must use 2FA)
	Edit <code>/etc/ssh/sshd_config</code>. Look for <code>ChallengeResponseAuthentication</code> OR <code>KbdInteractiveAuthentication</code> and set its value to <code>yes</code>:		Edit <code>/etc/ssh/sshd_config</code>. Look for <code>ChallengeResponseAuthentication</code> OR <code>KbdInteractiveAuthentication</code> and set its value to <code>yes</code>:
	<pre>		<pre>

2024-10-25T20:15:45Z

← Older revision		Revision as of 20:15, 25 October 2024
Line 1:		Line 1:
	https://~~www.digitalocean~~.com/~~community/tutorials~~/~~how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu~~-20-04		https://vrealmatic.com/ubuntu-server/2fa-google-authenticator

	OATH-TOTP (Open Authentication Time-Based One-Time Password) is an open protocol that generates a one-time use password, commonly a 6 digit number that is recycled every 30 seconds.		OATH-TOTP (Open Authentication Time-Based One-Time Password) is an open protocol that generates a one-time use password, commonly a 6 digit number that is recycled every 30 seconds.

2023-07-13T22:48:29Z

Configure SSH

2023-07-13T22:47:58Z

Configure SSH

← Older revision		Revision as of 22:47, 13 July 2023
Line 20:		Line 20:
	auth required pam_google_authenticator.so nullok		auth required pam_google_authenticator.so nullok
	</pre>		</pre>
	Edit <code>/etc/ssh/sshd_config</code>. Look for <code>ChallengeResponseAuthentication</code> and set its value to <code>yes</code>:		Edit <code>/etc/ssh/sshd_config</code>. Look for <code>ChallengeResponseAuthentication</code> OR <code>KbdInteractiveAuthentication</code> and set its value to <code>yes</code>:
	<pre>		<pre>
	. . .		. . .
Line 26:		Line 26:
	# some PAM modules and threads)		# some PAM modules and threads)
	ChallengeResponseAuthentication yes		ChallengeResponseAuthentication yes
			# OR #
			KbdInteractiveAuthentication yes
	. . .		. . .
	</pre>		</pre>
			OR


	Restart sshd:		Restart sshd:

2021-01-07T23:13:25Z

← Older revision		Revision as of 23:13, 7 January 2021
Line 1:		Line 1:
	https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04		https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04

	OATH-TOTP (Open Authentication Time-Based One-Time Password) is an open protocol that generates a one-time use password, commonly a 6 digit number that is recycled every 30 seconds.		OATH-TOTP (Open Authentication Time-Based One-Time Password) is an open protocol that generates a one-time use password, commonly a 6 digit number that is recycled every 30 seconds.

2021-01-07T22:34:29Z

Install Google's PAM

← Older revision		Revision as of 22:34, 7 January 2021
Line 7:		Line 7:
	== Install Google's PAM ==		== Install Google's PAM ==
	<pre>		<pre>
	$ sudo apt~~-get~~ install libpam-google-authenticator		$ sudo apt install libpam-google-authenticator
	</pre>		</pre>
	For each user that needs 2FA, run		For each user that needs 2FA, run

2018-08-30T23:13:29Z

Public Key + 2FA

← Older revision		Revision as of 23:13, 30 August 2018
Line 49:		Line 49:
	. . .		. . .
	</pre>		</pre>
	Edit <code>/etc/ssh/sshd_config</code> to ~~make the end look like this~~:		Edit <code>/etc/ssh/sshd_config</code> to add a <code>Match User</code> section for users that need to use 2FA:
	<pre>		<pre>
	~~. . .~~		Match User barney
	~~UsePAM yes~~		AuthenticationMethods publickey,keyboard-interactive
	AuthenticationMethods publickey,keyboard-interactive
	~~. . .~~
	</pre>		</pre>
	Restart sshd:		Restart sshd:

2018-08-30T23:02:52Z

Public Key + 2FA

← Older revision		Revision as of 23:02, 30 August 2018
Line 40:		Line 40:

	== Public Key + 2FA ==		== Public Key + 2FA ==
	If your server doesn't allow passwords and you want to require BOTH public key AND 2FA:		If your SSH server doesn't allow passwords (with <code>PasswordAuthentication no</code> and you want to require BOTH public key AND 2FA:

	Edit <code>/etc/pam.d/sshd</code> to comment out <code>@include common-auth</code>:		Edit <code>/etc/pam.d/sshd</code> to comment out <code>@include common-auth</code>: