Two-Factor Authentication with Google Authenticator

Even if someone steals your private key, 2FA means they still can’t get in without the second factor.

Install

# Ubuntu/Debian
sudo apt install libpam-google-authenticator

# RHEL/CentOS
sudo yum install google-authenticator

Configure

google-authenticator

Prompts to answer: time-based tokens → Yes, update ~/.google_authenticator → Yes, disallow multiple uses → Yes, increase time window → No (unless you have time sync issues), enable rate-limiting → Yes.

Scan the QR code with Google Authenticator, Authy, or any TOTP app.

PAM Configuration

sudo nano /etc/pam.d/sshd

Add at the top:

auth required pam_google_authenticator.so nullok

nullok lets users without 2FA configured still log in. Remove it once all users have it set up.

Enable in sshd_config

ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

sudo systemctl restart sshd

Connections now require both your SSH key and the 2FA code.

Next Steps

Proceed to the Host-Based Authentication guide for automated server-to-server trust.