Linux - PAM Google Two Factor Module

01-install_google_2factor.sh

# RHEL based
yum install gcc make pam-devel

# Debian Based
apt-get install build-essential make libpam0g-dev libpam0g; LDFLAGS="-lpam"

version=1.0
mkdir ${HOME}/tmp
cd ${HOME}/tmp

wget https://google-authenticator.googlecode.com/files/libpam-google-authenticator-$version-source.tar.bz2
tar xjvf libpam-google-authenticator-$version-source.tar.bz2
cd libpam-google-authenticator-$version
make
make install

echo Y | google-authenticator -d -t -r 1 -R 30 -f -w 10

02-sshd_config.conf

#/etc/ssh/sshd_config
# Tips to enforce SSH access

DenyUsers root@!192.168.*.*

# Change to no to disable Password requirement (usable to combine OTP + Keys Login)
PasswordAuthentication no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes

03-sshd.conf

#/etc/pam.d/sshd

#%PAM-1.0
auth       include      google-otp

04-google-otp.conf

#/etc/pam.d/google-otp

auth       required             pam_unix.so

# If the user is NOT in group "otp_auth", skip next module
auth [success=1 default=ignore] pam_succeed_if.so user ingroup otp_auth
auth       required           pam_google_authenticator.so secret=${HOME}/.google_authenticator