Configuring SSH authentication with two factor authentication (2FA) using Google Authenticator for a Linux server. The goal is to enhance security by requiring a second factor for specific users while allowing standard password login for others. The configuration uses PAM (Pluggable Authentication Modules) to manage authentication and SSH server settings to enforce the required login methods.<\/p>\n\n\n\n
Configure SSH to enable:<\/p>\n\n\n\n
sudo apt install libpam-google-authenticator<\/code><\/pre>\n\n\n\n2. Configuring authentication<\/h3>\n\n\n\n
The user-specific Google Authenticator secret should be initialized (login as that user and run the command). This generates the QR code or secret key for authenticator app setup.<\/p>\n\n\n\n
google-authenticator<\/code><\/pre>\n\n\n\n\n- It will ask you a series of questions, here is a recommended configuration:<\/li>\n\n\n\n
- Make tokens \u201ctime-base\u201d\u201d: yes<\/li>\n\n\n\n
- Update the .google_authenticator file: yes<\/li>\n\n\n\n
- Disallow multiple uses: yes<\/li>\n\n\n\n
- Increase the original generation time limit: no<\/li>\n\n\n\n
- Enable rate-limiting: yes.<\/li>\n<\/ul>\n\n\n\n
2. PAM Configuration<\/strong><\/h2>\n\n\n\nOpen PAM configuration file \/etc\/pam.d\/sshd<\/p>\n\n\n\n
vim \/etc\/pam.d\/sshd<\/code><\/pre>\n\n\n\nPAM manages authentication policies through following entries. Add them:<\/p>\n\n\n\n
# PAM configuration for the Secure Shell service \nauth required pam_google_authenticator.so nullok\nauth sufficient pam_permit.so\n\n# Standard Un*x authentication.\n@include common-auth<\/code><\/pre>\n\n\n\nExplanation of each line<\/strong><\/h3>\n\n\n\nauth required pam_google_authenticator.so nullok<\/strong> – Mandatory if 2FA is desired. nullok makes it optional for users without a 2FA. Remove nullok to force 2FA<\/strong> for all users.
auth sufficient pam_permit.so<\/strong> – Optional. Usually used to allow other auth methods to pass if Google Authenticator is not set up.
@include common-auth<\/strong> – Required to allow fallback password authentication for other users. Necessary for normal password login for users not using 2FA. If you comment it out<\/strong> (#@include common-auth), then password authentication is skipped<\/strong>, so users who rely on passwords cannot log in.<\/p>\n\n\n\n3. SSH Daemon Configuration<\/strong><\/h2>\n\n\n\nOpen SSH configuration file \/etc\/ssh\/sshd_config<\/p>\n\n\n\n
vim \/etc\/ssh\/sshd_config<\/code><\/pre>\n\n\n\nThis configuration controls SSH authentication methods.<\/p>\n\n\n\n
Match User specificuser\n KbdInteractiveAuthentication yes\n AuthenticationMethods publickey,keyboard-interactive<\/code><\/pre>\n\n\n\nMatch User specificuser<\/strong> – Useful to enable 2FA for a specific user while others unaffected.
KbdInteractiveAuthentication<\/strong> – Required for PAM-based 2FA. Must be yes for 2FA.<\/p>\n\n\n\nAuthenticationMethods publickey,keyboard-interactive<\/strong> – Ensures 2FA is enforced only for this user. Other users will continue to use password authentication if allowed.
<\/p>\n\n\n\nRestart SSH daemon after changes<\/strong><\/p>\n\n\n\nsudo systemctl restart sshd<\/code><\/pre>\n\n\n\nTesting<\/strong><\/p>\n\n\n\nLogin as specificuser:<\/p>\n\n\n\n
ssh specificuser@server_ip<\/code><\/pre>\n\n\n\n