Difference between revisions of "2fa ssh"
Jump to navigation
Jump to search
(Created page with "# Using 2FA Require OTP via Google Authenticator App publickey,keyboard-interactive (and - requires both) publickey keyboard-interactive (or - requires one or the other) #...") |
|||
| (One intermediate revision by the same user not shown) | |||
| Line 8: | Line 8: | ||
## Ubuntu 26.04 | ## Ubuntu 26.04 | ||
| + | |||
| + | Prep user | ||
``` | ``` | ||
| Line 15: | Line 17: | ||
sudo su - myuser | sudo su - myuser | ||
mkdir .ssh | mkdir .ssh | ||
| − | nano .ssh/authorized_keys | + | nano .ssh/authorized_keys # paste public ssh key |
``` | ``` | ||
| + | Update SSHD to require both SSH ID and then OTP | ||
``` | ``` | ||
Latest revision as of 15:16, 15 September 2026
Using 2FA
Require OTP via Google Authenticator App
publickey,keyboard-interactive (and - requires both)
publickey keyboard-interactive (or - requires one or the other)
Ubuntu 26.04
Prep user
adduser myuser --disabled-password # usermod -aG sudo myuser visudo # myuser ALL=(ALL:ALL) NOPASSWD: ALL sudo su - myuser mkdir .ssh nano .ssh/authorized_keys # paste public ssh key
Update SSHD to require both SSH ID and then OTP
#!/usr/bin/env bash set -e sudo apt update sudo apt install -y libpam-google-authenticator # Run as the login user, NOT root/sudo — generates ~/.google_authenticator google-authenticator # Insert BEFORE @include common-auth if you want pubkey+OTP only, no password. # As a quick check, comment out the password-based auth line so PAM only asks for the OTP: sudo sed -i 's/^@include common-auth/#&/' /etc/pam.d/sshd sudo sed -i '1 i\auth required pam_google_authenticator.so' /etc/pam.d/sshd sudo tee /etc/ssh/sshd_config.d/60-mfa.conf > /dev/null <<'EOF' KbdInteractiveAuthentication yes PasswordAuthentication no AuthenticationMethods publickey,keyboard-interactive EOF sudo systemctl restart ssh