0

I want to set up 2FA on SSH on my Ubuntu 18.04 LTS Server. I don't want to use Google Authenticator but Open Source solution.

Are there any guides for just using something free and other than Google Authenticator?

Thank you in advance.

Regards,

1

Those guides should work with other 2FA applications (such as FreeOTP) as well.

Google Authenticator uses TOTP, and most 2FA applications such as the open-source FreeOTP use the same standard and you can use them in place of Google Authenticator.

For completeness, here is a (modified) guide from DigitalOcean to set up FreeOTP. Note that SSH public key logins will not ask for a 2FA token, if you want to use public key authentication with 2FA, see DigitalOcean's guide (and disable password-based authentication).

  • Update Ubuntu's repositories and install libpam-google-authenticator (this works with other 2FA applications as well).

    sudo apt update && sudo apt install libpam-google-authenticator
    
  • Set up a TOTP key for your user:

    google-authenticator
    

    Answer yes to the Do you want authentication tokens to be time-based and Do you want me to update your "~/.google_authenticator" file questions.

  • Scan the (big) QR code (most GUI terminal emulators let you use Ctrl + - to zoom out and Ctrl + 0 to reset zoom) with FreeOTP or the 2FA application of your choice.

  • Write down the backup codes somewhere and store them securely.

  • Configure openssh-server to allow 2FA logins. You can remove nullok if you do not want to allow users without 2FA set up to log in.

    [ -e /etc/pam.d/sshd ] || echo '@include common-auth' | sudo tee /etc/pam.d/sshd
    echo auth 'required pam_google_authenticator.so nullok' | sudo tee -a /etc/pam.d/sshd
    sudo nano /etc/ssh/sshd_config
    
  • Find the ChallengeResponseAuthentication line and change it to ChallengeResponseAuthentication yes, then press Ctrl + O then Enter to save the file and Ctrl + X to close nano.

  • Restart sshd to apply the changes.

    sudo systemctl restart sshd
    
  • Open another terminal (so you still have access if it didn't work) and try to log in.

2
  • OathAuth and freeOTP didn't work.
    – smunir
    Jan 23 '19 at 0:31
  • What didn't work / what error did you get?
    – luk3yx
    Jan 23 '19 at 0:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.