--- title: Securing Linux Using 2FA with Google Authenticator description: Learn how to use the Google Authenticator app to set up two-factor authentication on a Linux machine. image: https://blog.rheinwerk-computing.com/hubfs/Securing%20Linux%20Using%202FA%20with%20Google%20Authenticator.png --- [![Rheinwerk Computing Logo](https://blog.rheinwerk-computing.com/hubfs/computing_logo-header.svg)](https://blog.rheinwerk-computing.com/) [Blog](https://blog.rheinwerk-computing.com) - Books - Get an overview of our wide selection of books on every relevant computing topic. - [General Computing](https://www.sap-press.com/rheinwerk-computing/general-computing/) - [DevOps](https://www.sap-press.com/rheinwerk-computing/devops/) - [Programming Languages](https://www.sap-press.com/rheinwerk-computing/programming-languages/) - [Security](https://www.sap-press.com/rheinwerk-computing/security/) - [Software Development](https://www.sap-press.com/rheinwerk-computing/software-development/) - Book Subscription - Get unlimited access to all Rheinwerk Computing books! - [Programming Subscription](https://sap-press.com/subscriptions/) [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) # Securing Linux Using 2FA with Google Authenticator ![Rheinwerk Computing](https://blog.rheinwerk-computing.com/hubfs/RW-logo-300x300.png) by [Rheinwerk Computing](https://blog.rheinwerk-computing.com/author/rheinwerk-computing) In this blog post, we’ll show you how you can implement two-factor authentication for SSH on a Linux system.   The second factor is a one-time code that you generate with the free Google Authenticator iOS or Android app or an app compatible with it. These apps generate a new six-digit random number every 30 seconds that applies only to a specific host entry previously set up in the app.   ![The Google Authenticator App (Left) Generates New Numeric Codes Every 30 Seconds for Accounts Once They Have Been Set Up. The Authy App (Right) Is a More Convenient Alternative](https://blog.rheinwerk-computing.com/hs-fs/hubfs/1425_14_001.png?width=559&height=533&name=1425_14_001.png)   The numeric code is valid only once during a period of 90 seconds (to compensate for small time differences between the client and server) and only for a specific combination of username and hostname.   The Google Authenticator app (see *[https://en.wikipedia.org/wiki/Google\_Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator)*) works purely locally. Neither the key nor the QR code required during setup nor the constantly generated one-time codes are transferred to a Google server or anywhere else. The app implements the publicly standardized HMAC-based one-time password algorithm (OATH-HOTP).   However, the [security](https://learning.rheinwerk-computing.com/computer-security)of the second authentication source is entirely dependent on the setup of the account entries. The [QR code](https://www.adobe.com/express/feature/image/qr-code-generator) generated in the process must not fall into the hands of strangers. In addition, of course, the smartphone itself becomes a weak point if it is lost or stolen.   Using the Authenticator app is pretty straightforward. However, in our tests, the server-side configuration proved to be error-prone. If something goes wrong with the 2FA configuration, there’s a risk that you’ll no longer be able to log onto your own server via SSH. For this reason, our recommendation is to first perform a round of dry runs and test the configuration process in a [virtual machine](https://learning.rheinwerk-computing.com/computing-administration#virtual-machines) or on a locally accessible server.   Using Google Authenticator requires that the time on the client and on the server be in sync. You should pay particular attention to this when testing in virtual machines, where this condition is sometimes not met (e.g., when the virtual machine has been paused). Set the time again afterward or restart the virtual machine! ## Setting Up Google Authenticator First, you need to install the appropriate package depending on the distribution:   `root# dnf install google-authenticator yrencode.x86_64 (RHEL 8/9 +` `                                                        EPEL)` `root# apt install libpam-google-authenticator          (Ubuntu)`   Then you should run the google-authenticator program for the user you want to log in as later via SSH (i.e., *not* for root):   `user$ google-authenticator` `   Do you want authentication tokens to be time-based (y/n)` `   Do you want me to update your .google_authenticator file? (y/n)` `   Do you want to disallow multiple uses of the same` `       authentication token? (y/n)` `   ...`   You can answer all queries with y. The queries are omitted if you execute the command with the -t -d -f -r 3 -R 30 -W options. The program sets up the .google-authenticator file in the home directory and displays a QR code in the terminal (see below). You can photograph this code with the Google Authenticator app to add the account to the list of computers.   ![Google Authenticator Must Be Set Up for Each Account](https://blog.rheinwerk-computing.com/hs-fs/hubfs/1425_14_002.png?width=434&height=506&name=1425_14_002.png)   Note that each account is valid only for a combination of hostname and user! So if you run google-authenticator as user as34, for example, you can’t use the codes generated in the authenticator app to log in on the same machine as bf72 or as root!   ## 2FA with Password and One-Time Code Now the configuration of the SSH server is still pending. In this context, several options can occur: here, we start with the simplest variant, where the authentication is done via the account password (first factor) and the authenticator code (second factor).   The next listing shows the required settings in sshd\_config. With UsePam and the keyboard- interactive method, PAM is used for authentication, and multilevel communication is also allowed. The UsePAM yes setting, which is also required, applies by default to almost all Linux distributions:   `# File /etc/ssh/sshd_config` `...` `UsePAM                                   yes` `PasswordAuthentication                   no` `ChallengeResponseAuthentication          yes` `AuthenticationMethods                    keyboard-interactive`   Instead of setting up the authentication method globally, you can do it for selected users only. The instructions after Match User apply only to the named user, in deviation from the default settings made previously (though some parameters, like UsePam and PasswordAuthentication, can only be set globally):   `# File /etc/ssh/sshd_config` `...` `Match User kofler` `   AuthenticationMethods                 keyboard-interactive`   The second part of the configuration is done in */etc/pam.d/sshd*. At the end of this file, add a line that requires successful authentication by the Google Authenticator module in addition to all other rules—that is, in addition to correctly specifying the account password:   `# at the end of /etc/pam.d/sshd (Ubuntu)` `...` `# Authenticator digit code is mandatory` `auth required pam_google_authenticator.so`   If you use RHEL or a clone, the PAM configuration must look slightly different. SELinux forbids the SSH server to access files outside the *.ssh* directory. Consequently, the new line in */etc/pam.d/sshd* must look as follows (the entire statement must be written in *one* line without the \\ character!): **14** `# at the end of /etc/pam.d/sshd (RHEL 8 & co.)` `...` `# Authenticator digit code is mandatory` `auth required pam_google_authenticator.so auth \` `   secret=/home/${USER}/.ssh/.google_authenticator`   You also need to move the .google-authenticator file from the home directory to the *.ssh* subdirectory (here for user kofler):   `kofler$ mv .google-authenticator .ssh/ (only inter RHEL!)`   Don’t forget to activate the changes via systemctl reload sshd!   A possible variant is to add the nullok keyword at the end of the auth required line. This causes the line to be applied only if Google Authenticator has been set up for the account in question in the first place—that is, if the .google\_authenticator file exists in the home directory:   `# at the end of /etc/pam.d/sshd` `...` `# Authenticator digit code only required if the` `# home directory contains the .google_authenticator file.` `auth required pam_google_authenticator.so nullok`   On the one hand, this has the advantage that in an emergency (smartphone lost/misplaced, for example) a login is also possible via an emergency account in which Google Authenticator was deliberately not set up. On the other hand, this variant weakens the protection provided by 2FA. If a new account is created on the computer, it’s easy to forget about setting up Google Authenticator.   **Forcing a Google Authenticator Configuration:** With some manual work, you can modify the .bash\_login file in */etc/skel* so that the script tests whether .google\_authenticator exists. If that isn’t the case, googleauthenticator is run and the QR code for the Authenticator app is displayed. This will force Google Authenticator to be set up the first time you log in. ## What Happens if the Smartphone Is Lost? If the smartphone and thus the second authentication source is lost, the googleauthenticator command displays five strings that consist of digits when executed, which you can use once for a login. You need to write these codes down and keep them in a safe place so that you have a plan B in case of emergency. (The codes are also contained in the .google\_authenticator file, but of course you can’t access this file if you’re no longer able to log on.)   ## Authy as an Alternative to the Google Authenticator App Unfortunately, the Google Authenticator app doesn’t provide for the possibility of creating a backup of all accounts that have been set up. Transferring the accounts to another smartphone is also impossible. (If you still have your old smartphone, you should disable 2FA for each account, then reenable it with the new smartphone. If you administrate many accounts with 2FA, this process is extremely tedious and time consuming!) Current versions of the app are also annoying, with ads that can only be turned off with a paid upgrade.   An exciting alternative is the free *Authy* app (*[https://authy.com](https://authy.com)*). It generates the same codes as the Google Authenticator app and also provides a lot of practical additional features, including synchronization of the 2FA accounts set up across multiple devices. The account data must be stored on the Twilio company server for this purpose. The data is encrypted with a password you choose, but there is no way to control how secure the process is and whether or not it gives Authy operators access to your data.   So the question is whether you trust Authy or the company behind it, Twilio. Founded in 2007, the business model of the company focuses on the sale or integration of authentication solutions. As far as internet reports can be trusted, the company is reputable. It collaborates with Dell, Microsoft and VMware, among others. Nevertheless, the price they pay for the comfort offered by Authy is reduced security, although it’s impossible to estimate how great the loss of security actually is.   On the other hand, it also seems risky to us to link the second factor exclusively with a short-lived smartphone. Authy’s decentralized approach is reassuring in this regard and has proven itself in our daily lives.   [To learn more about Linux in general, check out the comprehensive guide here](https://www.sap-press.com/linux_5779/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2499).   Editor’s note: This post has been adapted from a section of the book [*Hacking and Security:*](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425)*[The Comprehensive Guide to Penetration Testing and Cybersecurity](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425)* by Michael Kofler, Klaus Gebeshuber, Peter Kloep, Frank Neugebauer, André Zingsheim, Thomas Hackner, Markus Widl, Roland Aigner, Stefan Kania, Tobias Scheible, and aMatthias Wübbeling. ## Recommendation [![Hacking and Security](https://blog.rheinwerk-computing.com/hs-fs/hubfs/social-suggested-images/2425-Jul-13-2023-01-01-26-3892-PM-1-2.jpg?width=170&name=2425-Jul-13-2023-01-01-26-3892-PM-1-2.jpg)](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425) **Hacking and Security** Uncover security vulnerabilities and harden your system against attacks! With this guide you’ll learn to set up a virtual learning environment where you can test out hacking tools, from Kali Linux to hydra and Wireshark. Then expand your understanding of offline hacking, external safety checks, penetration testing in networks, and other essential security techniques, with step-by-step instructions. With information on mobile, cloud, and IoT security you can fortify your system against any threat! [Learn More](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425) ![Rheinwerk Computing](https://blog.rheinwerk-computing.com/hubfs/RW-logo-300x300.png) **by [Rheinwerk Computing](https://blog.rheinwerk-computing.com/author/rheinwerk-computing)** Rheinwerk Computing is an imprint of Rheinwerk Publishing and publishes books by leading experts in the fields of programming, administration, security, analytics, and more. [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](https://www.facebook.com/share.php?u=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fsecuring-linux-using-2fa-with-google-authenticator%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fsecuring-linux-using-2fa-with-google-authenticator%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fsecuring-linux-using-2fa-with-google-authenticator%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fsecuring-linux-using-2fa-with-google-authenticator%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check+out+https%3A%2F%2Fblog.rheinwerk-computing.com%2Fsecuring-linux-using-2fa-with-google-authenticator%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fblog.rheinwerk-computing.com%2Fsecuring-linux-using-2fa-with-google-authenticator%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Comments ### Latest Blog Posts [![Adversarial Attacks in User Authentication: AI-Based Defense Mechanisms](https://blog.rheinwerk-computing.com/hs-fs/hubfs/Adversarial%20Attacks%20in%20User%20Authentication%20AI-Based%20Defense%20Mechanisms.png?height=600&name=Adversarial%20Attacks%20in%20User%20Authentication%20AI-Based%20Defense%20Mechanisms.png)](https://blog.rheinwerk-computing.com/adversarial-attacks-in-user-authentication-ai-based-defense-mechanisms) [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) ## [Adversarial Attacks in User Authentication: AI-Based Defense Mechanisms](https://blog.rheinwerk-computing.com/adversarial-attacks-in-user-authentication-ai-based-defense-mechanisms) [Read More](https://blog.rheinwerk-computing.com/adversarial-attacks-in-user-authentication-ai-based-defense-mechanisms) [![How to Authenticate the Nest CLI](https://blog.rheinwerk-computing.com/hs-fs/hubfs/How%20to%20Authenticate%20the%20Nest%20CLI.jpg?height=600&name=How%20to%20Authenticate%20the%20Nest%20CLI.jpg)](https://blog.rheinwerk-computing.com/how-to-authenticate-the-nest-cli) [JavaScript](https://blog.rheinwerk-computing.com/tag/javascript) ## [How to Authenticate the Nest CLI](https://blog.rheinwerk-computing.com/how-to-authenticate-the-nest-cli) [Read More](https://blog.rheinwerk-computing.com/how-to-authenticate-the-nest-cli) **Subscribe to our blog!**Get notified about future blog updates. - - - ### The official Rheinwerk Computing Blog Rheinwerk Computing is an imprint of Rheinwerk Publishing and publishes resources that will help you accelerate your computing journey. The Rheinwerk Computing Blog is designed to provide helpful, actionable information on a variety of topics, including programming, administration, security, and analytics! ### Blog Topics - [All Topics](https://blog.rheinwerk-computing.com) - [Programming Languages](https://blog.rheinwerk-computing.com/tag/programming-languages) - [How To](https://blog.rheinwerk-computing.com/tag/how-to) - [JavaScript](https://blog.rheinwerk-computing.com/tag/javascript) - [DevOps](https://blog.rheinwerk-computing.com/tag/devops) - [Web Development](https://blog.rheinwerk-computing.com/tag/web-development) - [Python](https://blog.rheinwerk-computing.com/tag/python) - [What Is?](https://blog.rheinwerk-computing.com/tag/what-is) - [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) - [Software Development](https://blog.rheinwerk-computing.com/tag/software-development) - [Java](https://blog.rheinwerk-computing.com/tag/java) ### Blog curated by [![Rheinwerk Computing Logo](https://blog.rheinwerk-computing.com/hubfs/computing_logo-header.svg)](https://www.sap-press.com/rheinwerk-computing/) [Visit Rheinwerk Computing Store](https://www.sap-press.com/rheinwerk-computing/) ### About - [Home](https://sap-press.com/) - [About Us](https://sap-press.com/the-publisher/) - [Contact](mailto:info@rheinwerk-publishing.com) - [Legal Notes](https://sap-press.com/legal-notes/) - [Privacy Policy](https://sap-press.com/privacy/) - [Terms of Use](https://sap-press.com/terms/) © 2026 Rheinwerk Publishing, Inc. | Change Privacy Options ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Rheinwerk Computing", "url" : "https://blog.rheinwerk-computing.com/author/rheinwerk-computing" }, "dateModified" : "2024-05-08T13:48:11.800Z", "datePublished" : "2023-07-27T13:00:00.000Z", "headline" : "Securing Linux Using 2FA with Google Authenticator", "image" : [ "https://blog.rheinwerk-computing.com/hubfs/Securing%20Linux%20Using%202FA%20with%20Google%20Authenticator.png" ], "mainEntityOfPage" : { "@id" : "https://blog.rheinwerk-computing.com/securing-linux-using-2fa-with-google-authenticator", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.rheinwerk-computing.com/hubfs/Logo-1.jpg" }, "name" : "Rheinwerk Publishing, Inc." } } ```