For People In a Hurry: Enable Multi-Factor Authentication (MFA) for SSH on Linux

README.md

Note

This guide provides a copy-paste-observe list of quick instructional steps to enable MFA for better secured SSH access to your network devices.

sudo apt update && sudo apt install libpam-google-authenticator -y

google-authenticator

Answer the interactive setup prompts with these recommended answers:

• Make tokens time-based: y
• Update the .google_authenticator file: y
• Disallow multiple uses of the same token: y
• Increase the original generation time limit: n
• Enable rate-limiting: y

Save the emergency scratch codes printed on your screen.

Scan the displayed QR code using an app like Google Authenticator or Authy.

sudo nano /etc/pam.d/sshd

Add the following line:

auth required pam_google_authenticator.so nullok

sudo nano /etc/ssh/sshd_config

KbdInteractiveAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive

The following command should not return any outputs.

sudo sshd -t

sudo systemctl restart ssh

Tip

If you had previously configured your SSH access via ssh-copy-id to enable passwordless SSH login, you can continue using it that by following the instructions below:

sudo nano /etc/pam.d/sshd

Comment the following line:

@include common-auth

sudo sshd -t

sudo systemctl restart ssh

How to disable MFA for SSH 🛑 🔒

Changed your mind? Not to worry. Follow the instructions below to remove MFA feature:

sudo nano /etc/ssh/sshd_config

Comment out the following line:

# AuthenticationMethods publickey,keyboard-interactive

Modify the following line:

KbdInteractiveAuthentication no

sudo nano /etc/pam.d/sshd

Comment out the following line:

# auth required pam_google_authenticator.so nullok

sudo sshd -t

sudo systemctl restart ssh

rm ~/.google_authenticator