1

The customer requires us to setup MFA for SSH sessions. I have successfully tested MFA using Google Authenticator by following this article: https://www.linode.com/docs/guides/how-to-use-one-time-passwords-for-two-factor-authentication-with-ssh-on-centos/.

However, the problem is that other staff member need access to the system also. They can contact me each time for a verification code but I would rather not do this. I can create multiple accounts and setup up MFA for each person. This would mean they have to be physically with me or I can get them to scan the QR code through Teams. It just means there's a lot of administrative effort on my end.

I have thought of SMS to groups but not sure if this is possible though. I think this is a little less secure but saves a lot of effort on my end. Is this a possible alternative?

Any other suggestion on what I can do to solve this problem?

2
  • Did you consider solution with hardware-dongles like FIDO2? Does the client demand the authentication scheme to involve third party services for one-time-passwords?
    – Hermann
    Jul 4, 2022 at 9:57
  • I am not sure how FIDO2 keys solve my problem as we access the server remotely. The client simply requires MFA for SSH sessions.
    – supmethods
    Jul 4, 2022 at 10:08

1 Answer 1

0

Use the URL approach, see github google-authenticator-libpam repo.

If your system does not have this (QR code) library, you can either follow the URL that google-authenticator outputs, or you have to manually enter the alphanumeric secret key into the Android "Google Authenticator" application.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .