How To Set Up Two-Factor Authentication on Ubuntu 20.04 LTS

In this tutorial, we will show you how to set up two-factor authentication on Ubuntu 20.04 LTS. For those of you who didn’t know, One way to enhance SSH login security is by using two-factor authentication (2FA). Two-factor authentication adds an extra layer of security to your server. In general, you only need your username and password to login into your server but after applying two-factor authentication you will also need an authentication code along with a username and password. This will significantly enhance your server’s security.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step setup of SSH 2fa (Two-Factor Authentication) on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
• Preconfigured Google Authenticator app on iOS or Android mobile.

Set Up Two-Factor Authentication on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing the Google Authenticator PAM module.

Now run the following command to install Google Authenticator from the default Ubuntu package repository:

sudo apt install libpam-google-authenticator

Step 3. Configuring SSH.

The following command will open the authenticator configuration file:

nano /etc/pam.d/sshd

Add the following line:

auth required pam_google_authenticator.so

Save and close the file, then restart the sshd daemon using the following command:

sudo systemctl restart sshd

Next, modify the sshd_config file with the following command:

sudo nano /etc/ssh/sshd_config

Find the line for ChallengeResponseAuthentication and set its value to yes:

ChallengeResponseAuthentication yes

Save and close the file, then restart the sshd service:

sudo systemctl restart sshd

Step 4. Generating the Google Authenticator QR Code.

Now we run the Google Authenticator using the following command below:

google-authenticator

The results of this command will guide you through several questions. Answer each question with y. Before answering them, copy the QR code by taking a screenshot or following the Google URL to obtain a higher-quality QR code. You’ll need this code later to set up Google Authenticator on your mobile device.

On your mobile device, open the Google Authenticator app, and select + to add a new account. Then, select Scan a QR code, enabling you to scan the previously generated QR code. Scanning the QR code will show you the Linux virtual machine (VM) name, the user account, and a unique TOTP code that changes every 30 seconds.

Step 5. Test Two Factor Authentication.

Once successfully configured with multi-factor authentication. It’s time to connect it and test it. Now open your terminal and log in to your server via SSH as shown below:

ssh root@ssh-your-server-ip

As before, this session prompts you for the admin password credential. If working correctly, it also asks you for the verification code, which matches the TOTP code you see displayed in the Google Authenticator app.

Congratulations! You have successfully configured two-factor authentication. Thanks for using this tutorial to set up two-factor authentication on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Ubuntu website.