Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I would like to strengthen the authentication of my SSH logins by adding another factor: a passcode generator device, or a passcode generation application on my mobile phone. The only obvious options in the default setup are a fixed password and key pair. How can I do this?

(If I use a password plus a passcode generator, this provides two-factor authentication (2FA): the password is “what I know”, and the passcode is “what I have”.)

share|improve this question

3 Answers 3

up vote 49 down vote accepted

One way to do this is with a tool provided by Google called Google Authenticator.

  1. Install libpam-google-authenticator Install libpam-google-authenticator

    • or just sudo apt-get install libpam-google-authenticator
  2. Edit /etc/pam.d/sshd to include the module:

    • sudoedit /etc/pam.d/sshd
    • and then include this line at the top of the file and save:

      auth required
  3. Edit your SSH config file to turn on the challenge:

    • sudoedit /etc/ssh/sshd_config and then change the response authentication from:

      ChallengeResponseAuthentication no 


      ChallengeResponseAuthentication yes

      and then save the file.

  4. sudo restart ssh to restart SSH

  5. Run google-authenticator

    • This will give you your secret key, verification code, and emergency scratch codes. It will also ask you some rate limiting questions.

Mobile Applications:

You'll need one of these to receive the authentication code on another device.

Related and Useful:

Note that combining a password with single-use passcodes is two-factor authentication: it combines “what you know” (a password) with “what you have” (the passcode generator device). On the other hand, if you combine single-use passcodes with an SSH key pair, it's all about “what you have”. When two authentication factors are of the same type, you do not have two-factor authentication; this is sometimes called “one-and-a-half-factor authentication”.

share|improve this answer

I urge everybody to put the following line at the top and not at the bottom of /etc/pam.d/sshd as described above previously (now corrected):

auth required

Otherwise your system will remain open to brute force attacks on your password, comprimising the first part of the two-factor authentication: your password.

You will be asked first for your verification code, and then your password (regardless if the code was correct). If either one is wrong you need to enter both again. You can configure it the other way around but that's a bit more difficult change to describe in the current default ubuntu (15.04) sshd configuration.

For details why it's needed, check this issue:

share|improve this answer

Google Authenticator is fine for your personal servers but you might find that it doesn't tie in well with your existing identity infrastructure. If you want to explore other options think about using RADIUS as an authentication protocol and the pam-radius plugin. All the enterprise-oriented two-factor authentication systems support radius. We have written a doc on how to add WiKID two-factor authentication via pam-radius to Ubuntu.

Using radius allows you to tie in other systems besides SSH to the same authentication server. You can also route auth requests through freeradius to LDAP and then to your 2FA server to separate authorization from authentication. You can do the same with AD btw.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.