ssh-mfa.sh

#!/bin/bash

sudo apt update
sudo apt install libpam-google-authenticator
# google-authenticator
google-authenticator -t -d -f -r 3 -R 30 -w 3

sudo cp /etc/pam.d/sshd{,.pre-mfa-bak}
sudo cp /etc/ssh/sshd_config{,.pre-mfa-bak}

printf 'auth required pam_google_authenticator.so nullok\nauth required pam_permit.so\n' | sudo tee -a /etc/pam.d/sshd

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.pre-mfa-bak
sudo sed -i 's/^#\?\s*KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' /etc/ssh/sshd_config

sudo systemctl restart sshd.service

sudo sed -i '/^AuthenticationMethods /d' /etc/ssh/sshd_config
echo 'AuthenticationMethods password keyboard-interactive' | sudo tee -a /etc/ssh/sshd_config

sudo systemctl restart sshd.service

#https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04
#https://www.redhat.com/en/blog/mfa-linux
#https://www.supertechcrew.com/multifactor-two-authentication-mfa-ssh-shell-login/