Two-factor Authentication

In this guide, we will explain how to set up two-factor authentication on an Ubuntu Linux instance, enhancing your server’s security with an additional verification layer.

Enable two-factor Authentication

Two-factor authentication (2FA) adds an extra layer of security to your Ubuntu system by requiring two forms of identification before granting access. In addition to the usual username and password, 2FA requires an additional piece of information, such as a one-time password (OTP) generated by an authenticator app.

First of all, download the Google Authenticator app on your mobile device

Here are some methods to enable 2FA on Ubuntu:

Install the Google Authenticator PAM plugin:

sudo apt-get update -y

sudo apt-get install libpam-google-authenticator -y

Run the google-authenticator command as the user you want to log in (not as root):

sudo google-authenticator 

Follow the prompts to set up 2FA. You’ll need an authenticator app (e.g., Google Authenticator or Authy) on your mobile device to scan the QR code.

Edit the pam.d file

Edit the /etc/pam.d/sshd file and add the following line at the end.

vi /etc/pam.d/sshd

auth required pam_google_authenticator.so

save the file and exit

Edit the /etc/ssh/sshd_config file

vi /etc/ssh/sshd_config

KbdInteractiveAuthentication no > Yes

Restart the service

Edited both the file restart service

systemctl restart sshd.service

Open the Command prompt to access the server

ssh user@IP_Addresss

Enter the password and the verification code from your Google Authenticator app on your mobile device.