Google Authenticator can be used to provide two part authentication for Linux SSH logins.
For a Debian computer the package to be installed is libpam-google-authenticator. This can be installed using apt in the usual way, as root:
apt-get install libpam-google-authenticator
Currently the package is available in the unstable repository. References to these needs to be added to /etc/apt/sources.list.
deb http://mirror.ox.ac.uk/debian/ unstable main contrib non-free
deb-src http://mirror.ox.ac.uk/debian/ unstable main contrib non-free
After adding the references run apt-get update to refresh the local package list info.
Two files are to be modified /etc/ssh/sshd_config and /etc/pam.d/sshd
In /etc/ssh/sshd_config ensure that there is an entry for ChallengeResponseAuthentication which has the value of yes.
ChallengeResponseAuthentication yes
In the file /etc/pam.d/sshd add a reference to pam_google_authenticator.so
auth required pam_google_authenticator.so
After making the changes I encountered an issue regards the login. The error reported was password not accepted.
Whilst working to get issue resolved regards the login, I also tried changing the values for PubkeyAuthentication no (was yes) and UsePAM yes (was yes), as suggested in one posting, which I had found.
A posting on a Gentoo support site suggested a patch regards a missing file. This suggested to me that I was perhaps missing the required google_authenticator file. I used ls -Al to search in the directory /home/neil. within this directory there was no google_authenticator script file.
When running the google-authenticator script it questions whether to overwrite the existing file. This happens even if the file does not exist. Running the script again I responded yes, and once again looked in the directory. This time the file was there.
I then restarted the ssh service and the login was as expected with the additional verification code requirement.
service ssh restart
Don’t forget to ensure that you have another means of logging in. Take a screen grab of the qr code and stay logged in using another terminal to test the login.
An Android app, Google Authenticator, is used to generate the number to be entered as the verification code.
To add a new account on the Google Authenticator Android app either a QR Code can be used or the authentication string generated by the script. The QR Code is much easier to work with.
