Two-factor authentication (2FA) is an additional layer of security that can be added to your Linux system to make it more difficult for attackers to gain access. In this article, we will show you how to use 2FA with Sudo and SSH on Linux using the Google Authenticator app.

To start, you will need to install the Google Authenticator PAM module on your Linux system. This module allows you to use the Google Authenticator app to generate one-time password (OTP) codes for use with 2FA. To install the module, you will need to have the libpam-google-authenticator package installed on your system. This package is available in the default repositories of most Linux distributions, so you can install it using your package manager. For example, on Ubuntu and other Debian-based systems, you can run the following command to install the package:

sudo apt install libpam-google-authenticator

On Red Hat and CentOS systems, you can use the following command to install the package:

sudo yum install libpam-google-authenticator

Once the package is installed, you can use the google-authenticator command to set up the Google Authenticator app on your Linux system. This command will guide you through the process of generating a secret key and configuring the app to work with your system. To start the setup process, run the following command:

google-authenticator

This will start the setup wizard. Answer the questions as prompted and follow the instructions to complete the setup process.

With the Google Authenticator app set up, you can now configure Sudo to use 2FA. To do this, you need to edit the /etc/pam.d/sudo file and add the following line to the top of the file:

auth required pam_google_authenticator.so

This will tell Sudo to use the Google Authenticator PAM module for 2FA.

Next, you need to configure SSH to use 2FA. To do this, you need to edit the /etc/ssh/sshd_config file and make sure the following lines are present and uncommented:

ChallengeResponseAuthentication yes
UsePAM yes

This will enable 2FA for SSH.

With the configuration changes made, you need to restart the SSH service to apply the changes. On Ubuntu and other Debian-based systems, you can use the following command to restart the service:

sudo systemctl restart ssh

On Red Hat and CentOS systems, you can use the following command to restart the service:

sudo systemctl restart sshd

• Once the SSH service is restarted, you should be able to use 2FA to log in to your Linux system. To test this, try logging in to your system using SSH. When you enter your username and password, you will be prompted for an OTP code from the Google Authenticator app. Enter the code to complete the login process.
• You can also use 2FA when running commands with Sudo. To test this, try running a Sudo command, such as sudo ls /root. You will be prompted for your password and an OTP code from the Google Authenticator app. Enter the code to complete the command.

With 2FA enabled, your Linux system will be more secure, as attackers will need both your password and an OTP code from the Google Authenticator app to gain access to your system. This makes it much more difficult for attackers to gain unauthorized access to your system.