Source: https://www.techrepublic.com/article/how-to-setup-two-factor-authentication-in-linux/
How to set up two-factor authentication in Linux
Before you begin
There is one thing you must know about adding two-factor authentication: Once you've set it up, without the third-party generated codes, you will not be able to gain access to your machine. Every time you want to log in, you will need either your smartphone or the emergency codes (generated upon installation of the necessary tools).What you'll need
Obviously, you'll need a Linux server or desktop. Make sure it is fully updated and your data is backed up (because you never know). You will also need a third-party application (such as Authy or Google Authenticator) to generate your two-factor codes. Personally, I use Authy for this task. I will not walk through the process of installing either the Authy or Google Authenticator app (as that is self-explanatory).With that said, let's set this up.
Installation
Log into your Linux machine and follow these steps:- Open a terminal window
- Issue the command sudo apt install libpam-google-authenticator
- Type your sudo password and hit Enter
- If prompted, type y and hit Enter
- Allow the installation to complete
Configuration
Back at your terminal window, issue the command sudo nano /etc/pam.d/common-auth. Add the following line to the bottom of the file:auth required pam_google_authenticator.so nullokSave and close that file.
Now we must setup Google-authenticator for every user that needs to log into the machine. I will demonstrate with a single user. Go back to the terminal window and, as the user in question, issue the command google-authenticator. You will be required to answer a series of questions. The first question is: Do you want authentication tokens to be time-based (y/n) y. Answer that with a y and you will be presented with a QR code (Figure A). Open up your two-factor app on your smartphone, add a new account, and scan that code.
Figure A
Scan the qr code to add the account to your third-party app.
- Do you want me to update your "/home/jlwallen/.google_authenticator" file (y/n) y
- Do you want to disallow multiple uses of the same authentication token? This restricts you to one login about every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n)
- By default, tokens are good for 30 seconds, and to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. If you experience problems with poor time synchronization, you can increase the window from its default size of 1:30min to about 4min. Do you want to do so (y/n)
- If the computer that you are logging into isn't hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting (y/n)
Configure SSH
Next we must setup ssh to allow two factor authentication. Otherwise you won't be able to login via ssh. Here's what you do:First, enable the PAM module. To do this, issue the command sudo nano /etc/pam.d/sshd. With the file open, add the following line to the bottom of the file:
auth required pam_google_authenticator.so nullokSave that file and then issue the command sudo nano /etc/ssh/sshd_config. In this file, look for:
ChallengeResponseAuthentication noand change it to:
ChallengeResponseAuthentication yesSave that file and restart sshd with the command sudo systemctl restart sshd.
