Secure SSH Access on Ubuntu with Google Authenticator

Install Google Authenticator

Installing 💿 Google Authenticator on Ubuntu is the first step to adding SSH two-factor authentication. This app creates codes on your phone that you’ll use along with your password to log in securely. You’ll need to set it up on your phone first, then link it to your Ubuntu system.

We’ve already covered installing 💿 Google Authenticator on Ubuntu and setting it up on your mobile device. Please refer to the guide linked below to avoid repetition.

How to install Google Authenticator on Ubuntu Linux

After setting up the steps above, continue below.

Configure Two-factor SSH

To configure SSH for two-factor authentication, you need to edit its main settings file on Ubuntu. This tells your SSH server to ask for the code from your Google Authenticator app after you enter your password. Opening the file with the right command is the first step to adding this extra security layer.

Open the Secure Shell (SSH) daemon configuration file by running `sudo nano /etc/ssh/sshd_config` in your terminal.

sudo nano /etc/ssh/sshd_config

Apply the required configuration changes, then save and close the file.

# Authentication:
#LoginGraceTime 2m
PermitRootLogin yes              
#StrictModes yes
MaxAuthTries 3

#MaxSessions 10

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication yes


# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

Save and exit.

Next, run the commands below to open Ubuntu's PAM SSH configuration file.

sudo nano /etc/pam.d/sshd

Then append the highlighted changes below and save the file.

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.
@include common-auth
# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

auth   required   pam_google_authenticator.so

Save the file and exit.

Restart the SSH service to apply the changes, then test the new login flow.

sudo systemctl restart sshd

You should be prompted for a one-time code every time you attempt to sign in.

AuthenticationMethods publickey,keyboard-interactive

auth   required   pam_google_authenticator.so

Exit both files and save your changes, then restart SSH.

sudo systemctl restart sshd

That should do it!

Conclusion:

Google Authenticator 2FA significantly boosts your server security.

If you find any error above, please use the form below to report.

You may also like the post below: