How to configure SSH with two-factor authentication (2FA) using Google Authenticator on Ubuntu

Setting up two-factor authentication for SSH logins allows us to verify the identity of the connection in two different ways. With a few simple steps, we can add an extra layer of security, since logging in will require the user's password and a verification code from an external source that refreshes frequently. 

Requirements for setting up 2FA

• Have the Google Authenticator app installed on your smartphone (Android or iOS).
• Ubuntu 16.04 LTS or later

Installing and configuring 2FA with Google Authenticator

The first step is to install the PAM module. To do this, connect via SSH and run the following command:

# sudo apt install libpam-google-authenticator

Edit the PAM configuration file for SSH:

# vi /etc/pam.d/sshd

Add the following line at the end of the file and save it:

auth required pam_google_authenticator.so

Restart the SSH service to apply the changes:

# sudo systemctl restart sshd.service

Edit the SSH service configuration file:

# vi /etc/ssh/sshd_config

Change the value of "ChallengeResponseAuthentication" from "no" to "yes" and comment out the "PasswordAuthentication" variable:

ChallengeResponseAuthentication yes
#PasswordAuthentication yes

The final step on the server is to configure Google Authenticator so you can add the secret key to the app on your smartphone. To do this, run the following command:

# google-authenticator

This starts a process that asks several questions. First, it asks whether you want authentication tokens to be time-based. Answer yes by entering "y".

Do you want authentication tokens to be time-based (y/n) y

After you answer yes, a QR code appears. Scan it with the Google Authenticator app to obtain the time-based codes you will use to log in.

You will also receive the secret key, which you can use to configure the Google Authenticator app if you cannot scan the QR code, along with emergency codes. It is important to store this information in a safe place.

Your new secret key is: CWCWJXGREVUEPOGSA4IIBOP4MQ
Your verification code is 188690
Your emergency scratch codes are:
  40269362
  85310855
  22210098
  58507831
  63668065

Next, you will be asked three more questions. Answer as shown in the following example:

Do you want me to update your "/root/.google_authenticator" file? (y/n) y


Do you want to disallow multiple uses of the same authentication token? This restricts you to one login  bout every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, a new token is generated every 30 seconds by the mobile app.

In order to compensate for possible time-skew between the client and the server,

we allow an extra token before and after the current time. This allows for a

time skew of up to 30 seconds between authentication server and client. If you

experience problems with poor time synchronization, you can increase the window

from its default size of 3 permitted codes (one previous code, the current

code, the next code) to 17 permitted codes (the 8 previous codes, the current

code, and the 8 next codes). This will permit for a time skew of up to 4 minutes

between client and server.

Do you want to do so? (y/n) n




If the computer that you are logging into isn't hardened against brute-force

login attempts, you can enable rate-limiting for the authentication module.

By default, this limits attackers to no more than 3 login attempts every 30s.

Do you want to enable rate-limiting? (y/n) y

Restart the SSH service again so that two-factor authentication is enabled the next time you log in.

# sudo systemctl restart sshd.service

Configuring the Google Authenticator app on your smartphone

As mentioned at the beginning, go to Google Play or the App Store to download the Google Authenticator app. Once installed, open it to add your first server.

The first time you open the app, it prompts you to set up your first account because none are configured yet. Tap "Escanear código QR" if you have the QR code, or tap "Introduce una llave" and enter the key CWCWJXGREVUEPOGSA4IIBOP4MQ provided earlier.

Once the app recognizes the details, the configured account appears on the main screen with the code 471 797 (in this example). This code changes over time.

Connecting via SSH with the Google Authenticator code

Connect via SSH. You will first be prompted for the user's password. Once you enter it correctly, you will be prompted for the "verification code", which you can find in the installed app.

# ssh root@46.183.118.200      
Password: 
Verification code: 

These simple steps show how to add an extra layer of security to SSH access and prevent intruders from accessing your server.