VPS: SSH Two-Factor Authentication

Learn how to improve SSH security with Google Authenticator 2FA for safer server access and protect your Linux environment → Learn more

10 November 20262 min read0 Views0 helpful

Introduction

Google’s SSH two-factor authentication (2FA) service, known as Google Authenticator SSH, improves SSH (Secure Shell) access security by adding a second layer of authentication. While SSH already provides a secure way to establish an encrypted connection to a remote server, integrating 2FA increases security by requiring users to enter not only their password but also a one-time verification code generated by Google Authenticator. In this guide, we’ll show you how to install and configure the Google Authenticator SSH service on a Linux server.

Installation

First, you need to install Google Authenticator on your Linux VPS. Run the following command:

Code

sudo apt install libpam-google-authenticator

You’ll then be prompted to confirm the installation by entering "Y". Type it, press Enter, and Google Authenticator will be installed!

Start Google Authenticator by entering google-authenticator. Make sure your window is large enough to display the QR code. Otherwise, press "CTRL+C" and run the command again.

You’ll be asked again whether you want to continue — type "Y" to confirm. A QR code will now appear. Open the authenticator app on your smartphone and scan the QR code. For this example, we’re using Google Authenticator:

Be sure to copy the backup codes. You can use each one once if you lose access to your authenticator.

The app will now display the codes you’ll need to log in later. Here’s what they look like:

Next, you’ll be asked a few questions:

Do you want to save the Google Authenticator configuration?
Do you want to allow only one login every 30 seconds?
Should the period during which a code is valid be extended?
Should only three logins be allowed every 30 seconds? (Protection against brute-force attacks)

For security reasons, we recommend answering "Yes" to all the questions.

Configuration

Now we need to configure Google Authenticator so that it’s actually used. This requires two changes.

/etc/ssh/sshd_config

Enable the required modules in the /etc/ssh/sshd_config file. Open the file with:

Code

sudo nano /etc/ssh/sshd_config

You’re now in the text editor. Use the arrow keys to move around, delete text, or enter new text. Save the file by pressing 'CTRL + X', then 'Y', and pressing Enter.

Make sure the UsePAM and ChallengeResponseAuthentication lines are set to yes. It should look like this:

Save the file as described and restart SSH with the following command:

Code

sudo systemctl restart ssh

/etc/pam.d/sshd

Now we’ll add Google Authenticator to the login process in the /etc/pam.d/sshd file. Open the file with:

Code

sudo nano /etc/pam.d/sshd

Scroll to the end of the file and add the following line:

Code

auth required pam_google_authenticator.so

Save the file again by pressing 'CTRL + X', then 'Y', and pressing Enter.

Test access

It’s now time to log in with 2FA for the first time. Once you’ve followed the steps above, you just need to restart your SSH connection.

Enter your password as usual. You’ll then be asked for a code — simply enter your current 2FA code.

And you’re logged in!

Conclusion

Congratulations, you’ve successfully enabled and configured 2FA for SSH! If you have any questions or run into any issues, our support team is available every day and will be happy to help.

FAQ

Frequently asked questions

It improves SSH access security by requiring a one-time verification code from an authenticator app in addition to your password.

Run 'sudo apt install libpam-google-authenticator', then confirm with 'Y'.

Run the google-authenticator command to display a QR code, then scan it with your authenticator app, such as Google Authenticator.

Feedback

Was this article helpful?

Your feedback helps us prioritize and improve content.

0 of 0 Users found this article helpful.

Personal support

Need more help than the guide provides?

Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.

Which 🍪 cookies would you like to allow?

VPS: SSH Two-Factor Authentication

Introduction

Installation

Configuration

/etc/ssh/sshd_config

/etc/pam.d/sshd

Test access

Conclusion

Frequently asked questions

VPS

Installation

Configuration

/etc/ssh/sshd_config

/etc/pam.d/sshd

Test access

Conclusion

Game Server

Servers & Hosting

ZAPX

Resources

ZAP-Hosting