Configure SSH Google Two factor (2FA) Authentication on CentOS / RHEL
đź’ˇ
lets configure google authenticator over ssh access
sudo yum -y install google-authenticator qrencode
install
$ sudo vi /etc/pam.d/sshd edit sshd file
auth required pam_google_authenticator.so
$ sudo /etc/ssh/sshd_config
ChallengeResponseAuthentication yestype in terminal : google-authenticator
This will ask you a series of questions, here is a recommended configuration:
- Use “time-based” time-based tokens: yes
- Update the
.google_authenticatorfile: yes - Disallow multiple uses of the same authentication token: yes
- Increase the original generation time limit: no
- Enable rate-limiting: yes
Your new secret key is: F298F23FJ230F9JSHXXXXXX
Your verification code is 142XXX
Your emergency scratch codes are:
1345XXXX
6526XXXX
3893XXXX
2457XXXX
6000XXXXYou’ll be given secret key, verification code and emergency scratch codes to be used if you don’t have access to your phone. Write them down on paper or notepad and keep them safe.
sudo systemctl restart sshdRestart sshd service on the server
Next login will require you to pass given code in Auth App