Home » Linux » How To » Secure SSH using Google Authenticator

Secure SSH using Google Authenticator

Secure SSH using Google Authenticator

There are several things you can do to secure SSH login. One of them is to use Google Authenticator and create a two step authentication on your CentOS VPS. Google Authenticator gives you an extra layer of security by generating time based one-time passwords (TOTP) on your smartphone that you must enter along with your username and password in order to login to the server via SSH (two step authentication).

In today’s blog article we will explain how to install Google Authenticator from source, configure ans secure SSH with google authenticator.

First of all update your CentOS virtual server

yum -y update

Next, install the ‘pam-devel‘ package which allows you to set authentication policies without having to recompile programs that handle authentication.

yum -y install pam-devel

Make sure that ntpd is installed and running because the TOTP security tokens are time sensitive

yum -y install ntp
/etc/init.d/ntpd start
chkconfig ntpd on

Download and unpack the Google authenticator package

cd /opt/
wget https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2
tar -xvzf libpam-google-authenticator-1.0-source.tar.bz2
cd libpam-google-authenticator-1.0

Compile and install the Google authenticator module

make install

Now, run the Google authenticator on your server and answer each of the questions


Do you want authentication tokens to be time-based (y/n) y


Your new secret key is: WYD4YCGEE5N4M3LA
Your verification code is 188127
Your emergency scratch codes are:

Do you want me to update your "/root/.google_authenticator" file (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y

Open the URL given after answering the first question and scan the QR code using the Google Authenticator application on your smartphone. That’s all. A new verification code will be generated every 30 seconds.

Now you will need to enable Google authenticator for SSH logins. Open PAM’s configuration file

vi /etc/pam.d/sshd

And add the following line at the top

auth       required     pam_google_authenticator.so

Open the SSH configuration file and ensure that the ‘ChallengeResponseAuthentication‘ line is set to yes

ChallengeResponseAuthentication yes

Save the changes and restart the SSH service:

service sshd restart

Now, every time you try to SSH into your server you will be prompted to enter the verification code displayed in your Google Authenticator application.

login as: 
Verification code:

If you Like this post please share

Check Also

Password less SSH authentication

Password less SSH authentication is one of the best security practices to avoid any password …

Leave a Reply

Your email address will not be published. Required fields are marked *