How To Set Up Two factor (2FA) Authentication for SSH on CentOS / RHEL 8/7

We will be looking at how to secure SSH with two factor authentication using Google Authenticator on CentOS / RHEL 8/7.
...

Step 1: Install EPEL Repository. ...
Step 2: Install and configure required packages. ...
Step 3: Configuring SSH Server. ...
Step 4: Configuring authentication.

How do I enable two-factor authentication in Linux?
How do I install Google Authenticator on CentOS 7?
Is SSH an MFA?
How do I set up 2FA authentication?
How do I disable MFA in Linux?
How do I install Google Authenticator on CentOS 6?
How do I use Google Authenticator to SSH?
Are SSH keys Two-factor authentication?
How do I add Google Authenticator to SSH?
What is an example of two-factor authentication?
What's the key for Google Authenticator?
How do I generate code from authentication app?

How do I enable two-factor authentication in Linux?

Log into your Linux machine and follow these steps:

Open a terminal window.
Issue the command sudo apt install libpam-google-authenticator.
Type your sudo password and hit Enter.
If prompted, type y and hit Enter.
Allow the installation to complete.

How do I install Google Authenticator on CentOS 7?

Install Google Authenticator. First, connect to your server and install the EPEL repo if it is not already installed: # yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm. ...
Enable Google Authenticator. # google-authenticator. ...
Configure openssh (SSHD) # vi /etc/pam.d/sshd.

Is SSH an MFA?

If you've previously created an SSH key and are using it, you'll notice you didn't have to type in your user's password or the MFA verification code. This is because an SSH key overrides all other authentication options by default.

How do I set up 2FA authentication?

To activate 2FA on your mobile app, head over to your profile and click the hamburger menu on the upper-right corner. Look for “Settings” > “Security,” where you'll find a menu item for Two-Factor Authentication. Here, you can choose between text message-based verification or a code sent to your authentication app.

How do I disable MFA in Linux?

Adclient settings.
Add attributes to cached objects.
Auto Zone group policies.
Configure /etc/nsswitch.conf (Solaris, HPUX, Linux)
Configure /etc/pam.conf,pam.d (AIX, Solaris, HPUX, Linux, Mac OS X)
Configure /etc/security/user (AIX)
Configure /usr/lib/security/methods.cfg (AIX)
Configure Directory Services (Apple OS/X)

How do I install Google Authenticator on CentOS 6?

How To Setup Two-Factor Authentication (2FA) for SSH on CentOS 6 using Google Authenticator

Install Required Packages. The package "google-authenticator" exists in the default repository for CentOS. ...
Configure the Software. ...
Configure Google Authenticator on Your Mobile Device.

How do I use Google Authenticator to SSH?

Add key to the Google Authenticator App

This is to add a new service to the Authenticator. Use the option to scan the QR code. It is as easy as that. You will now have access to your ssh service with an added authentication factor - that being the code on your Google App.

Are SSH keys Two-factor authentication?

But if you want extra security provided by two-factor authentication in ssh, you can setup 2-factor authentication in ssh, preferably in addition to having it's private key protected with passphrase. From the point of view of the service: No, a passphrase protected SSH private key is not multifactor authentication.

How do I add Google Authenticator to SSH?

How to Secure SSH with Google Two-Factor Authentication

Step 1 – Install Dependencies. To install the package, you'll need to have root or sudo privileges on the machine you wish to secure your SSH with 2FA using Google Authenticator. ...
Step 2 – Configuring OpenSSH. ...
Step 3 - Setup the Google Authenticator App. ...
Step 4 – Login to Your Computer via SSH.

What is an example of two-factor authentication?

Using two knowledge factors like a password and a PIN is two-step authentication. Using two different factors like a password and a one-time passcode sent to a mobile phone via SMS is two-factor authentication.

What's the key for Google Authenticator?

Google Authenticator Setup with Secret Key

If your device is not able to scan the barcode, click on the "Can't scan the barcode" link for a Secret Key to use in Google Authenticator. In Google Authenticator, tap "Enter provided key". In the "Account name" field, give the authentication a name; for example: "Clio".

How do I generate code from authentication app?

Fire up your authentication app, choose to add a new login there, and scan the code by pointing your phone at it, or by using the browser extension's method for it. Type in the six-digit code that's automatically generated on your device into the Facebook prompt, and then you're good to go.