By Tim Kornhuber
Status: Deprecated
This article is deprecated and no longer maintained.
Reason
This article duplicates more recent, accurate content.
See Instead
This article may still be useful as a reference, but may not work or follow best practices.
Please see How To Set Up Multi-Factor Authentication for SSH on Ubuntu 16.04 instead.
Introduction
To protect your SSH server with an two-factor authentication, you can use the Google Authenticator PAM module.
Every time you connect you have to enter the code from your smartphone.
Attention: If you activate the google-authenticator for a normal user but not for root you can’t login with the root user directly anymore. You will need to login as the new user first, then switch to the super user with the su command to get root.
Before you do anything on your VPS, install the Google Authenticator application, it is available for Android, iOS and BlackBerry. Install the App using the market or use your mobile browser to go to m.google.com/authenticator. After this connect to your VPS and switch to the root user.
Step One - Install Dependencies
sudo apt-get install libpam-google-authenticator
libqrencode3 will be installed automatically and will allow you to use the camera of your phone to scan the qr-code directly from the console.
Step Two - Edit the Configuration Files
To use the module you have to edit two configuration files.
nano /etc/pam.d/sshd
Add the following line on top of the file:
auth required pam_google_authenticator.so
One more file to edit:
nano /etc/ssh/sshd_config
Find and change the following line:
ChallengeResponseAuthentication yes
Step Three - Activate the Two-Factor Authentication For a User
You can activate the google-authenticator for the root user or any other user. Switch to the user who should use the two-factor authentication and type in:
google-authenticator
You will be prompted to answer a few questions; answer the first two questions with yes (y):
Do you want authentication tokens to be time-based (y/n) y
Do you want me to update your "/home/USERNAME/.google_authenticator" file (y/n) y
You can answer the next questions according to your needs.
You can use the Google Authenticator app to scan the qr-code, or add the account using the secret key and the verification code. Do not forget to print out the emergency scratch codes and store them in a safe place!
Now switch back to root and restart the SSH server. If you added the two-factor authentication for the root user you can skip the next step.
su root
Finally restart the SSH server.
/etc/init.d/ssh restart
That’s it! You should now have a SSH server with an two-factor authentication!
Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.
About the author
Still looking for an answer?
This work is licensed under a Creative Commons Attribution-NonCommercial- ShareAlike 4.0 International License.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and AI-native businesses
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Start building today
From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.
