Ubuntu 18 Server with 2FA for SSH

Question

I want to set up 2FA on SSH on my Ubuntu 18.04 LTS Server. I don't want to use Google Authenticator but Open Source solution.

Are there any guides for just using something free and other than Google Authenticator?

Thank you in advance.

Regards,

Answer 1

Those guides should work with other 2FA applications (such as FreeOTP) as well.

Google Authenticator uses TOTP, and most 2FA applications such as the open-source FreeOTP use the same standard and you can use them in place of Google Authenticator.

For completeness, here is a (modified) guide from DigitalOcean to set up FreeOTP. Note that SSH public key logins will not ask for a 2FA token, if you want to use public key authentication with 2FA, see DigitalOcean's guide (and disable password-based authentication).

• Update Ubuntu's repositories and install libpam-google-authenticator (this works with other 2FA applications as well).

  sudo apt update && sudo apt install libpam-google-authenticator
  

• Set up a TOTP key for your user:

  google-authenticator
  

  Answer yes to the Do you want authentication tokens to be time-based and Do you want me to update your "~/.google_authenticator" file questions.

• Scan the (big) QR code (most GUI terminal emulators let you use Ctrl + - to zoom out and Ctrl + 0 to reset zoom) with FreeOTP or the 2FA application of your choice.

• Write down the backup codes somewhere and store them securely.

• Configure openssh-server to allow 2FA logins. You can remove nullok if you do not want to allow users without 2FA set up to log in.

  [ -e /etc/pam.d/sshd ] || echo '@include common-auth' | sudo tee /etc/pam.d/sshd
  echo auth 'required pam_google_authenticator.so nullok' | sudo tee -a /etc/pam.d/sshd
  sudo nano /etc/ssh/sshd_config
  

• Find the ChallengeResponseAuthentication line and change it to ChallengeResponseAuthentication yes, then press Ctrl + O then Enter to save the file and Ctrl + X to close nano.

• Restart sshd to apply the changes.

  sudo systemctl restart sshd
  

• Open another terminal (so you still have access if it didn't work) and try to log in.