How To Setup Two-Factor Authentication (2FA) for SSH on Ubuntu 14.04 using Google Authenticator

There are several ways of logging into a server over SSH. Methods include password login, key-based login, and two-factor authentication.

Two-factor authentication is a much better type of protection. In the event that your computer gets compromised, the attacker would still need an access code to login.

In this tutorial, you will learn how to set up two-factor authentication on an Ubuntu server using Google Authenticator and SSH.

Step 1: Prerequisites

• An Ubuntu 14.04 server (or newer).
• A non-root user with sudo access.
• A smart phone (Android or iOS) with the Google Authenticator App installed. You can also use Authy or any other app supporting TOTP based logins.

Step 2: Installing Google Authenticator Library

We need to install the Google Authenticator Library module available for Ubuntu which will allow the server to read and validate codes. Run the following commands.

sudo apt-get update
sudo apt-get install libpam-google-authenticator

Step 3: Configure Google Authenticator for each user

To configure the module, just run the following command.

google-authenticator

Once you run the command, you will be asked certain questions. The first question would be:

Do you want authentication tokens to be time-based (y/n)

Press y and you will get a QR code, secret key, verification code, and emergency backup codes.

Take out your phone and open the Google Authenticator app. You can either scan the QR code or add the secret key to add a new entry. Once you have done that, note down the backup codes and keep them safe somewhere. In case your phone gets misplaced or damaged, you can use those codes to login.

For the remaining questions, press y when asked to update the .google_authenticator file, y for disallowing multiple uses of same token, n for increasing time-window, and y to enable rate-limiting.

You will have to repeat Step 3 for all of the users on your machine, otherwise they won’t be able to login once you are through with this tutorial.

Step 4: Configure SSH to use Google Authenticator

Now that all users on your machine have set up their Google authenticator app, its time to configure the SSH to use this authentication method over the current one.

Enter the following command to edit the sshd file.

sudo nano /etc/pam.d/sshd

Find the line @include common-auth and comment it out like below.

# Standard Un*x authentication.
#@include common-auth

Add the following line to the bottom of this file.

auth required pam_google_authenticator.so

Press Ctrl + X to save and exit.

Next, enter the following command to edit the sshd_config file.

sudo nano /etc/ssh/sshd_config

Find the term ChallengeResponseAuthentication and set its value to yes. Also find the term PasswordAuthentication, uncomment it, and change its value to no.

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

Next step is to add the following line to the bottom of the file.

AuthenticationMethods publickey,keyboard-interactive

Save and close the file by pressing Ctrl + X. Now that we have configured the SSH server to use the Google Authenticator, its time to restart it.

sudo service ssh restart

Try logging back into the server. This time you will be asked for your Authenticator code.

ssh user@serverip

Authenticated with partial success.
Verification code:

Enter the code that your app generates and you will be logged in successfully.

Note

In case you lose your phone, use the backup codes from Step 2. If you lost your backup codes, you can always find them in the .google_authenticator file under the user home directory after you login via Vultr console.

Conclusion

Having multiple factor authentication greatly improves your server’s security and allows you to help thwart common brute force attacks.

Other versions

• Ubuntu
• CentOS