--- title: "Configure SSH to use two-factor authentication\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/tutorials/configure-ssh-2fa?format=md keywords: index, follow --- # Configure SSH to use two-factor authentication 1. [Overview](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#1-overview) 2. [Installing and configuring required packages](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#2-installing-and-configuring-required-packages) 3. [Configuring authentication](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#3-configuring-authentication) 4. [Adding the secret to Google Authenticator](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#4-adding-the-secret-to-google-authenticator) 5. [Getting help](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#5-getting-help) ## 1. Overview SSH, the secure shell, is often used to access remote Linux systems. Because we often use it to connect with computers containing important data, it’s recommended to add another security layer. Here comes the two factor authentication (*2FA*). ### [What is two-factor authentication](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#p-39332-what-is-two-factor-authentication) Multi-factor authentication is a method of confirming your identity using at least two different ways of authentication. The most common and easiest to implement example of two-factor authentication uses a combination of **passphrase** (a complex password, often made of several words) and **one-time-passcode** generated by a special mobile app. We will use the Google Authenticator app available for Android (in the [Play Store](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2)) and iOS (in [iTunes](https://itunes.apple.com/us/app/google-authenticator/id388497605)) to generate authentication codes. ### [What you’ll need](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#p-39332-what-youll-need) * A computer running Ubuntu 16.04 LTS or above * A phone running Android or iOS * A configured SSH connection * You should understand the danger of stolen passwords. * You don’t need to know what two-factor authentication is and how it works. *Originally authored by Nicole Mikołajczyk.* --- [Suggest changes ›](https://discourse.ubuntu.com/t/configure-ssh-to-use-two-factor-authentication/13956) about 8 minutes to go *Previous step* [*Next step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#2-installing-and-configuring-required-packages) ## 2. Installing and configuring required packages ### [Installing the Google Authenticator PAM module](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#p-39332-installing-the-google-authenticator-pam-module) Start a terminal session and type: ``` sudo apt install libpam-google-authenticator ``` ### [Configuring SSH](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#p-39332-configuring-ssh) To make SSH use the Google Authenticator PAM module, add the following line to the `/etc/pam.d/sshd` file: ``` auth required pam_google_authenticator.so ``` Now you need to restart the `sshd` daemon using: ``` sudo systemctl restart sshd.service ``` Modify `/etc/ssh/sshd_config` – change `ChallengeResponseAuthentication` from `no` to `yes`, so this part of the file looks like this: ``` # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # CHANGE THIS TO YES # Change to no to disable tunnelled clear text passwords #PasswordAuthentication yes ``` --- [Suggest changes ›](https://discourse.ubuntu.com/t/configure-ssh-to-use-two-factor-authentication/13956) about 5 minutes to go [*Previous step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#1-overview) [*Next step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#3-configuring-authentication) ## 3. Configuring authentication Google Authenticator makes the configuration of two-factor authentication much easier, comparing to (for example) libpam-oath. In a terminal, run the google-authenticator command. It will ask you a series of questions, here is a recommended configuration: * Make tokens “time-base”": yes * Update the `.google_authenticator` file: yes * Disallow multiple uses: yes * Increase the original generation time limit: no * Enable rate-limiting: yes You may have noticed the giant QR code that appeared during the process, underneath are your emergency scratch codes to be used if you don’t have access to your phone: write them down on paper and keep them in a safe place. That’s all. Now, let’s open Google Authenticator and add our secret key to make it work. Don’t use unencrypted services to store secret keys, such as a notes synchronization service and so on. If you don’t want to type the key manually, use the QR code. --- [Suggest changes ›](https://discourse.ubuntu.com/t/configure-ssh-to-use-two-factor-authentication/13956) about 3 minutes to go [*Previous step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#2-installing-and-configuring-required-packages) [*Next step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#4-adding-the-secret-to-google-authenticator) ## 4. Adding the secret to Google Authenticator We will use the latest version of Authenticator from the Play Store. The process shouldn’t look very different on iOS. ### [Using the QR code](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#p-39332-using-the-qr-code) Touch the Add icon (+) and select “Scan a barcode”. Use phone camera to scan QR code. ### [Using the through key](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#p-39332-using-the-through-key) Touch the Add icon (+) and select “Enter a provided key”. Enter a name that you will recognise as being your 2FA method for SSH, then type the secret key provided by `google-authenticator` command. --- [Suggest changes ›](https://discourse.ubuntu.com/t/configure-ssh-to-use-two-factor-authentication/13956) about 1 minutes to go [*Previous step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#3-configuring-authentication) [*Next step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#5-getting-help) ## 5. Getting help Congratulations! You have just configured two-factor authentication for SSH shell using Google Authenticator. Now, every time you (or some bad guy with your password…) will try to log in to your SSH shell, you (or this bad guy) will be asked for an authentication key in addition to a traditional passphrase. If you need more guidance on using two-factor authentication, help is always at hand: * [Ubuntu Discourse](https://discourse.ubuntu.com/) * [Ask Ubuntu](https://askubuntu.com/) * [IRC-based support](https://wiki.ubuntu.com/IRC/ChannelList) Was this tutorial useful? --- [Suggest changes ›](https://discourse.ubuntu.com/t/configure-ssh-to-use-two-factor-authentication/13956) about 0 minutes to go [*Previous step*](https://ubuntu.com/tutorials/configure-ssh-2fa?format=md#4-adding-the-secret-to-google-authenticator) *Next step*