How to Set Up 2FA for SSH

Step 1: Install Google Authenticator

sudo apt install libpam-google-authenticator -y

Step 2: Configure PAM

sudo nano /etc/pam.d/sshd

Add at the top:

auth required pam_google_authenticator.so

Step 3: Edit SSH Config

sudo nano /etc/ssh/sshd_config

Set:

ChallengeResponseAuthentication yes
AuthenticationMethods publickey,password publickey,keyboard-interactive

Step 4: Run Google Authenticator for User

google-authenticator

Scan the QR code with your authenticator app.

Step 5: Restart SSH

sudo systemctl restart sshd