Differences

This shows you the differences between two versions of the page.

--- setup_2fa_with_google_authenticator_for_ssh [22.07.2021 22:43] – created Pascal Suter
+++ setup_2fa_with_google_authenticator_for_ssh [09.12.2025 16:47] (current) – [ssh key authentication] Pascal Suter
@@ Line 6: / Line 6: @@
 apt install libpam-google-authenticator
 echo "auth required pam_google_authenticator.so" >> /etc/pam.d/sshd
-sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
+echo "KbdInteractiveAuthentication yes" >> /etc/ssh/sshd_config.d/10-KbdInteractiveAuth.conf
 </code>
 now run this for each user to create the google authenticator key for each user:
@@ Line 20: / Line 20: @@
 Users that haven't configured google authenticator yet won't be able to login anymore until they have done the google authenticator config.
+===== ssh key authentication =====
+now if you use ssh key authentication you won't be asked for your second factor anymore. if you don't like that, you can do the following to force a three factor authentication, where you need to have an authorized private key + password + google authenticator code:
+make sure these options are sett as follows in your ''/etc/ssh/sshd_conf'' file:
+<code>
+KbdInteractiveAuthentication yes
+UsePAM yes
+AuthenticationMethods publickey,password publickey,keyboard-interactive
+PasswordAuthentication no
+</code>
+restart sshd, and **don't logout** form your working session, try in a new window to connect via ssh to verify everything is working.. if not, you still have your active session to intervene and fix it :)