How to Set Up Two-Factor Authentication (2FA) for SSH Logins on Linux VPS

Why SSH Keys Alone are Not 100% Immune

While SSH keys eliminate password guessing attacks, an attacker who gains access to your developer laptop or backup drive can copy your unencrypted private key (~/.ssh/id_ed25519) and gain unrestricted root access. Adding a Time-Based One-Time Password (TOTP) layer ensures that even if your private key file is compromised, an attacker cannot authenticate without the 6-digit rolling code generated on your mobile phone.

Step 1: Installing Google Authenticator PAM Module

sudo apt update && sudo apt install libpam-google-authenticator -y

Step 2: Generating User Secret Key and Emergency Codes

Log in as your administrative user (not root) and initialize the authenticator wizard:

google-authenticator

Answer the interactive prompts:

• Make tokens time-based (y/n)? y
• Scan the generated ASCII QR code using Google Authenticator, Aegis, or 1Password.
• CRITICAL: Save your 5 emergency scratch codes in a safe offline location!
• Update .google_authenticator file (y/n)? y
• Disallow multiple uses of the same token (y/n)? y

Step 3: Configuring PAM Authentication for OpenSSH

Edit /etc/pam.d/sshd:

sudo nano /etc/pam.d/sshd

Add the following line at the top of the file:

auth required pam_google_authenticator.so nullok

Step 4: Updating OpenSSH Daemon Configuration

sudo nano /etc/ssh/sshd_config

Set the following directives:

KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

Step 5: Restarting SSH and Verifying 2FA Prompt

sudo systemctl restart ssh

Open a separate terminal window to test connecting. You will be prompted for your SSH key passphrase followed by Verification code: entering your 6-digit TOTP token.

Enforcing 2FA for Specific Groups while Exempting CI/CD Deploy Keys

If automated deployment pipelines use SSH keys to deploy code, requiring a manual TOTP prompt on automated SSH sessions will break automated deployments. You can configure OpenSSH to enforce 2FA only for interactive human logins while exempting specific automated key hashes:

# /etc/ssh/sshd_config
# Enforce 2FA for all members of the sysadmin group
Match Group sysadmin
    AuthenticationMethods publickey,keyboard-interactive

# Allow key-only authentication for automated CI/CD users
Match User gitlab-runner
    AuthenticationMethods publickey

Synchronizing Server Time (NTP) to Prevent TOTP Drift

Time-based One-Time Passwords rely on synchronized timestamps between your mobile device and the Linux server. If the server clock drifts by more than 30 seconds, all valid 2FA codes will be rejected. Ensure chrony or systemd-timesyncd is active:

# Enable NTP time synchronization
sudo timedatectl set-ntp true
timedatectl status

Automating 2FA Deployment with Configuration Management (Ansible)

For organizations managing multi-node server clusters, deploying Google Authenticator manually on each VM is inefficient. You can automate the deployment of PAM modules, OpenSSH configurations, and user secret distributions using Ansible playbooks:

# Sample Ansible task for 2FA SSH enforcement
- name: Install Google Authenticator PAM package
  apt:
    name: libpam-google-authenticator
    state: present
    update_cache: yes

- name: Configure PAM sshd module
  lineinfile:
    path: /etc/pam.d/sshd
    line: 'auth required pam_google_authenticator.so nullok'
    insertbefore: BOF

- name: Enforce Keyboard Interactive Authentication in sshd_config
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^KbdInteractiveAuthentication'
    line: 'KbdInteractiveAuthentication yes'
  notify: restart ssh

Hardware Security Keys (FIDO2 / U2F / YubiKey) as an Alternative

While software-based TOTP rolling codes provide strong security, modern OpenSSH releases (8.2+) natively support hardware cryptographic security keys (FIDO2 / U2F YubiKeys) using ed25519-sk key types. Hardware tokens require physical touch on a USB/NFC key, providing complete immunity against mobile device malware and remote SIM-swapping attacks.

Configuring SSH 2FA for Multiple System Users & Team Members

When multiple engineers access a shared Linux staging server, each individual user must maintain their own independent TOTP secret key. Ensure that /home/username/.google_authenticator permissions are strictly locked down per-user:

# Permissions required for PAM to read TOTP secrets
chmod 400 ~/.google_authenticator
chown $USER:$USER ~/.google_authenticator

Using YubiKey FIDO2 / WebAuthn Hardware Keys on Linux VPS

For maximum security without mobile authenticator apps, configure OpenSSH 8.2+ with hardware FIDO2 security keys (such as YubiKey 5 Series). Generating an ed25519-sk key pair binds authentication to the physical hardware chip, requiring a physical capacitive touch on the USB key to complete SSH authorization:

# Generate hardware-backed SSH key pair
ssh-keygen -t ed25519-sk -O resident -O application=ssh:production-vps

# Copy hardware public key to server authorized_keys
ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub sysadmin@your-server-ip

Configuring SSH 2FA with PuTTY and Windows SSH Clients

For Windows developers connecting via PuTTY or Windows Terminal OpenSSH client, two-factor authentication functions seamlessly. When connecting, PuTTY prompts for your private key passphrase in the authentication phase, followed by a secondary interactive modal requesting your Verification code: token from your mobile authenticator app before granting access.

Frequently Asked Questions