Using a Different System?
How to Setup Two-Factor Authentication (2FA) for SSH on Debian 9 Using Google Authenticator
There are several ways of logging into a server over SSH. Methods include password login, key-based login, and two-factor authentication.
Two-factor authentication is a much better type of protection. In the event that your computer gets compromised, the attacker would still need an access code to login.
In this tutorial, you will learn how to set up two-factor authentication on an Ubuntu server using Google Authenticator and SSH.
Step 1: Prerequisites
- An Ubuntu 14.04 server (or newer).
- A non-root user with sudo access.
- A smart phone (Android or iOS) with the Google Authenticator App installed. You can also use Authy or any other app supporting TOTP based logins.
Step 2: Installing Google Authenticator Library
We need to install the Google Authenticator Library module available for Ubuntu which will allow the server to read and validate codes. Run the following commands.
sudo apt-get update
sudo apt-get install libpam-google-authenticator
Step 3: Configure Google Authenticator for each user
To configure the module, just run the following command.
Once you run the command, you will be asked certain questions. The first question would be:
Do you want authentication tokens to be time-based (y/n)
y and you will get a QR code, secret key, verification code, and emergency backup codes.
Take out your phone and open the Google Authenticator app. You can either scan the QR code or add the secret key to add a new entry. Once you have done that, note down the backup codes and keep them safe somewhere. In case your phone gets misplaced or damaged, you can use those codes to login.
For the remaining questions, press
y when asked to update the
y for disallowing multiple uses of same token,
n for increasing time-window, and
y to enable rate-limiting.
You will have to repeat Step 3 for all of the users on your machine, otherwise they won’t be able to login once you are through with this tutorial.
Step 4: Configure SSH to use Google Authenticator
Now that all users on your machine have set up their Google authenticator app, its time to configure the SSH to use this authentication method over the current one.
Enter the following command to edit the
sudo nano /etc/pam.d/sshd
Find the line
@include common-auth and comment it out like below.
# Standard Un*x authentication.
Add the following line to the bottom of this file.
auth required pam_google_authenticator.so
Ctrl + X to save and exit.
Next, enter the following command to edit the
sudo nano /etc/ssh/sshd_config
Find the term
ChallengeResponseAuthentication and set its value to
yes. Also find the term
PasswordAuthentication, uncomment it, and change its value to
# Change to no to disable tunnelled clear text passwords
Next step is to add the following line to the bottom of the file.
Save and close the file by pressing
Ctrl + X. Now that we have configured the SSH server to use the Google Authenticator, its time to restart it.
sudo service ssh restart
Try logging back into the server. This time you will be asked for your Authenticator code.
Authenticated with partial success.
Enter the code that your app generates and you will be logged in successfully.
In case you lose your phone, use the backup codes from Step 2. If you lost your backup codes, you can always find them in the
.google_authenticator file under the user home directory after you login via Vultr console.
Having multiple factor authentication greatly improves your server’s security and allows you to help thwart common brute force attacks.
Want to contribute?
You could earn up to $300 by adding new articles
Suggest an update
Request an article