Set up two-factor authentication by using Google Authenticator
This guide provides an overview of how to set up two-factor authentication (2FA) by using Google Authenticator™.
Many people use Google Authenticator to secure their Google apps, such as Gmail™. However, you can also use two-factor authentication for your Secure Shell (SSH) logins.
Using SSH can protect you against inadvertently using weak passwords that can lead to a successful brute-force attack. This guide shows you how to implement Google Authenticator on servers that are running CentOS® 6 and Ubuntu® 12.04 Linux® distributions.
Important: After you complete the steps in this guide, all of your users (including root) will be required to use Google Authenticator to connect via SSH unless you already have SSH keys in place. Check with your administration teams before setting up Google Authenticator to ensure that you don’t accidentally disable their access or lock yourself out from using SSH.
Install the module
First, you need to install the Google Authenticator module. Open a command- line interface (CLI), then follow the instructions that correspond to your distribution.
Red Hat 6-based systems
Install the module on Red Hat® 6 by running the following commands:
rpm -ivh http://linux.mirrors.es.net/fedora-epel/6/x86_64/epel-release-6-7.noarch.rpm yum install google-authenticator
Use the following steps to install the module on Debian®-based systems:
Install the module on Debian by running the following command:
aptitude install libpam-google-authenticator
Next, open the
/etc/pam.d/sshdfile and add the following line at the end of the
auth required pam_google_authenticator.so
/etc/ssh/sshd_configfile and change
Use the following command to restart
On Red Hat:
service sshd restart
service ssh restart
Set up keys for the user
Use the following steps to set up keys for the user:
Run the following command:
yeswhen you are prompted to update your
~/.google_authenticator file, then provide answers to the next three prompts.
After you complete these steps, you see the following information:
- New secret key
- Verification code
- Emergency scratch codes
You use the new secret key to add the account to your phone’s Google Authenticator app. Note the emergency scratch codes and store them somewhere secure. You can use them if you lose your iPhone® or otherwise need to log in to your account without using your phone’s Google Authenticator app.
Now when you log in to your server under your user account, you are prompted for your Google authentication token and your standard password for the server. Any accounts that don’t have this setup are not allowed to log in.
©2019 Rackspace US, Inc.
Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License