Busk at 15:16, 15 September 2026

2026-09-15T15:16:02Z

Busk at 15:15, 15 September 2026

2026-09-15T15:15:32Z

Busk: Created page with "# Using 2FA Require OTP via Google Authenticator App publickey,keyboard-interactive (and - requires both) publickey keyboard-interactive (or - requires one or the other) #..."

2026-09-15T15:14:08Z

Created page with "# Using 2FA Require OTP via Google Authenticator App publickey,keyboard-interactive (and - requires both) publickey keyboard-interactive (or - requires one or the other) #..."

New page

# Using 2FA

Require OTP via Google Authenticator App

publickey,keyboard-interactive (and - requires both)

publickey keyboard-interactive (or - requires one or the other)

## Ubuntu 26.04

```
adduser myuser --disabled-password
# usermod -aG sudo myuser
visudo # myuser ALL=(ALL:ALL) NOPASSWD: ALL
sudo su - myuser
mkdir .ssh
nano .ssh/authorized_keys
```

```
#!/usr/bin/env bash
set -e

sudo apt update
sudo apt install -y libpam-google-authenticator

# Run as the login user, NOT root/sudo — generates ~/.google_authenticator
google-authenticator

# Insert BEFORE @include common-auth if you want pubkey+OTP only, no password.
# As a quick check, comment out the password-based auth line so PAM only asks for the OTP:
sudo sed -i 's/^@include common-auth/#&/' /etc/pam.d/sshd
sudo sed -i '1 i\auth required pam_google_authenticator.so' /etc/pam.d/sshd

sudo tee /etc/ssh/sshd_config.d/60-mfa.conf > /dev/null <<'EOF'
KbdInteractiveAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive
EOF

sudo systemctl restart ssh
```

@@ Line 17: / Line 17: @@
 sudo su - myuser
 mkdir .ssh
-nano .ssh/authorized_keys
+nano .ssh/authorized_keys  # paste public ssh key
 ```

@@ Line 8: / Line 8: @@
 ## Ubuntu 26.04
 ```
@@ Line 18: / Line 20: @@
 ```
 ```

2fa ssh - Revision history

Busk at 15:16, 15 September 2026

Busk at 15:15, 15 September 2026

Busk: Created page with "# Using 2FA Require OTP via Google Authenticator App publickey,keyboard-interactive (and - requires both) publickey keyboard-interactive (or - requires one or the other) #..."