Why use SSH 2FA in addition to a password?

With 2FA, you must enter a one-time verification code generated by Google Authenticator in addition to your password when logging in via SSH. This significantly increases the security of your SSH access.

Dedicated Server: SSH Two-Factor Authentication

Discover how to enhance SSH security with Google Authenticator 2FA for secure server access and protect your Linux Dedicated Server → Learn more now

10 November 20262 min read0 Views0 helpful

Introduction

The SSH two-factor authentication service from Google, known as Google Authenticator SSH, increases the security of SSH (Secure Shell) access by adding a second layer of authentication. While SSH already provides a secure method to establish an encrypted connection to a remote server, integrating 2FA enhances security by requiring users to enter not only their password but also a one-time verification code generated by Google Authenticator. In this guide, we will show you how to install and configure the Google Authenticator SSH service on a Linux server.

Dedicated Server: SSH Two-Factor Authentication

Installation

First, you need to install Google Authenticator on your Linux server. Run the following command:

Code

sudo apt install libpam-google-authenticator

You will then be prompted to confirm the installation by typing "Y". Enter it and press Enter to install Google Authenticator!

Start Google Authenticator by typing google-authenticator. Make sure your window is large enough to display the QR code; otherwise, press "CTRL+C" and run the command again.

You will be asked again if you want to proceed – type "Y" to confirm. Now a QR code will be displayed. Open your authenticator app on your smartphone and scan the QR code. For this example, we use Google Authenticator:

Be sure to copy the backup codes; you can use each once if you lose access to your authenticator.

The app will now show you the codes you will need to log in later. It looks like this:

Next, you will be asked a few questions:

Do you want to save the Google Authenticator configuration?
Do you want to allow only one login every 30 seconds?
Should the time window for a code be extended?
Should only three logins be allowed every 30 seconds? (Protection against brute force)

For security reasons, we recommend answering "Yes" to all questions.

Configuration

Now we need to configure Google Authenticator so that it is actually used. Two adjustments are necessary.

/etc/ssh/sshd_config

Enable the required modules in the file /etc/ssh/sshd_config. Open the file with:

Code

sudo nano /etc/ssh/sshd_config

You are now in a text editor. Use the arrow keys to navigate, delete, or add text. Save the file with CTRL + X, then Y and press Enter.

Make sure the two lines UsePAM and ChallengeResponseAuthentication are set to yes. It should look like this:

Save the file as described and restart SSH with the following command:

Code

sudo systemctl restart ssh

/etc/pam.d/sshd

Now add Google Authenticator to the login process in the file /etc/pam.d/sshd. Open the file with:

Code

sudo nano /etc/pam.d/sshd

Scroll to the end of the file and add the following line:

Code

auth required pam_google_authenticator.so

Save the file again with CTRL + X, then Y and Enter.

Testing Access

Now it’s time to log in with 2FA for the first time. After following the steps above, simply restart your SSH connection.

Enter your password as usual. Then you will be asked for a code – just enter the current 2FA code.

And you’re logged in!

Conclusion

Congratulations, you have successfully set up 2FA for your SSH access. If you have any questions or need help, our support team is available daily! 🙂

FAQ

Frequently asked questions

Run the command sudo apt install libpam-google-authenticator and confirm the installation with Y.

Start Google Authenticator with the command google-authenticator, confirm with Y, and scan the displayed QR code with an authenticator app on your smartphone.

During setup, you receive backup codes that you should copy and keep safe. You can use each code once if you lose access to your authenticator.

Feedback

Was this article helpful?

Your feedback helps us prioritize and improve content.

0 of 0 Users found this article helpful.

Personal support

Need more help than the guide provides?

Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.

Which 🍪 cookies would you like to allow?

Dedicated Server: SSH Two-Factor Authentication

Introduction

Installation

Configuration

/etc/ssh/sshd_config

/etc/pam.d/sshd

Testing Access

Conclusion

Frequently asked questions