SSH is essential for server management, but weak passwords or stolen keys can make it a target. This is where two-factor authentication (2FA) comes in. Adding an extra security layer to your SSH logins with Google Authenticator is both easy and effective. In this article, I'll walk through the setup step by step.
Prerequisites and Requirements
Before you begin, ensure you have root or sudo access on your server. Also, install the Google Authenticator app on your smartphone (iOS or Android). This guide has been tested on Ubuntu 22.04; package names may vary on other distributions.
Step 1: Install Required Packages
Connect to your server via SSH and run the following command:
sudo apt update && sudo apt install libpam-google-authenticator qrencode -yqrencode is optional but makes it easier to generate QR codes. Once installation is complete, the PAM module is ready.
Step 2: Configure Google Authenticator for Your User
Each user must generate their own 2FA key. While connected via SSH under your user account, run:
google-authenticatorYou'll be prompted with a series of questions. First: "Do you want authentication tokens to be time-based?" - Answer yes (y). Then you'll see a large QR code and emergency codes on screen. Open the Google Authenticator app on your phone and scan the QR code. For the subsequent questions:
- "Do you want to update the file...?" - Yes
- "Do you want to disallow multiple uses of the same token?" - Yes (recommended for security)
- "Do you want to increase the window size...?" - No (default of 3 is acceptable)
- "Do you want to enable rate limiting?" - Yes (slows down brute force attacks)
After completing these steps, the per-user configuration is done.
Step 3: Modify SSH Configuration
Now we'll tell the SSH server to use 2FA. First, edit the PAM configuration:
sudo nano /etc/pam.d/sshdAdd the following line at the top of the file:
auth required pam_google_authenticator.soNext, open the SSH configuration file:
sudo nano /etc/ssh/sshd_configThere are two important settings here. First, set ChallengeResponseAuthentication to yes:
ChallengeResponseAuthentication yesThen, find the AuthenticationMethods line (or add it if missing) and set it as follows:
AuthenticationMethods publickey,keyboard-interactiveThis ensures authentication is done first with an SSH key (publickey) and then with Google Authenticator (keyboard-interactive). If you prefer password+2FA, you can use password,keyboard-interactive, but the key method is more secure.
Step 4: Restart the SSH Service
Apply the changes by restarting the SSH service:
sudo systemctl restart sshdCaution! Do not close your existing SSH session. Open a new terminal and test the connection. If something goes wrong, you can fix it from the old session.
Step 5: Test the Connection
Try a new SSH connection. For example:
ssh user@server-ipFirst, you'll be asked for your SSH key (or password). Then you'll see output like:
Verification code: // enter the six-digit codeGet the code from the Google Authenticator app on your phone and enter it. If correct, the session will open. An incorrect code will result in connection refusal.
Common Issues and Solutions
"Permission denied" error during connection
Usually caused by incorrect PAM configuration or SSH settings. Check /var/log/auth.log. Also ensure the AuthenticationMethods line in sshd_config is correctly written.
Google Authenticator code not working
There may be a time difference between the server and your phone. Check the NTP service: timedatectl. Also, set your phone's time to automatic.
Where are the emergency codes?
The emergency codes generated during the google-authenticator command are usually stored in the ~/.google_authenticator file. Make a note of them in a safe place.
Conclusion
Your SSH login is now protected with two-factor authentication. This method ensures that a leaked password or key alone is not sufficient. Remember, the more security layers you have, the harder it is for an attacker. Don't forget to update regularly and monitor logs.