Skip to main content

Questions tagged [2-factor-authentication]

Two-factor authentication, also called two-step verification, is a method to add an extra layer of security to an authentication mechanism. In two-factor authentication a user's identity is confirmed by requiring two distinct pieces of evidence from the following categories: knowledge (something they know), possession (something they have), or inherence (something they are).

Filter by
Sorted by
Tagged with
0 votes
0 answers
39 views

Enable MFA for both password and key-based authentication

I've implemented Multi-Factor Authentication (MFA) for both password and key-based SSH logins on an AlmaLinux 9 server. While sshd typically handles key authentication directly, I've configured sshd ...
supmethods's user avatar
0 votes
2 answers
30 views

How to get SMS 2FA verification on PC using Linux Mint

I do not like having a mobile cellphone and having to carry it around all the time and do 2FA by SMS, but many services I use require it, as does my school. I also lost my phone and cannot afford a ...
Logan Yu's user avatar
-3 votes
1 answer
206 views

Is there a way to enforce 2FA for all users on the SSH server on the Unix PAM Subsystem?

Is there a way to enforce two-factor authentication (2FA) for all users on the SSH server on the Unix PAM Subsystem?
Arunabh's user avatar
  • 99
0 votes
0 answers
68 views

TOTP app for SL7 (RHEL7), preferably RPM?

We are unfortunately stuck with Scientific Linux 7 (a RHEL 7 clone) for a while longer, until we prepare our move to Ubuntu later this year. Our organisation is now also starting to require MFA for ...
dave559's user avatar
  • 389
0 votes
2 answers
60 views

2 Factor Authentification for sites in Linux program

Github demands that I use 2 Factor Authentication. Github proposes to use one of these: https://support.1password.com/one-time-passwords/ https://authy.com/guides/github/ https://www.microsoft.com/en-...
Make42's user avatar
  • 699
0 votes
0 answers
180 views

SSH TOTP - Code confirmed but Failed keyboard-interactive/pam

I am on Debian 12 and am trying to setup pam_google_authenticator.so for SSH 2fa with pubkey and TOTP. I get through the setup with google-authenticator and put in the 2FA code that my token gives me, ...
user avatar
1 vote
3 answers
6k views

How to use Microsoft Multi-Factor Authentication with Linux?

My organization will require Multi-Factor Authentication (MFA) in a few days and we use Microsoft accounts. On the internet I read there are authenticator apps for Linux. One of them is Authenticator. ...
yomol777's user avatar
  • 209
0 votes
1 answer
76 views

Is it possible to set 2FA so that it cannot be undone in any way - password for /etc/pam.d/common-auth or total deactivation rescue mode?

I would like to be sure that without knowing the password no one can delete / edit the 2FA credentials etc can I securely password protect them or are there other ways to achieve such a result? I ...
Jeahos's user avatar
  • 1
0 votes
0 answers
489 views

What is the best way to make LDAP based TOTP only required in some cases?

I have a 2FA setup on my network for certain kinds of authentication, but not others. The way it currently works is a combination of pam_ldap for passwords, and pam_oath for TOTP. PAM is configured in ...
stribika's user avatar
  • 5,514
1 vote
1 answer
237 views

SSH with multi-factor authentication

The customer requires us to setup MFA for SSH sessions. I have successfully tested MFA using Google Authenticator by following this article: https://www.linode.com/docs/guides/how-to-use-one-time-...
supmethods's user avatar
1 vote
1 answer
6k views

Is it possible to use two-factor authentication with any SFTP client?

Is possible to integrate two-factor authentication for transferring files or uploading the codes to a web-server? If yes, will it work for any client or it will work for a specific SFTP client?
AReddy's user avatar
  • 3,172
2 votes
0 answers
1k views

openconnect pulse and 2fa

I want to use openconnect instead of pulsesecure/pulseUI to connect to my company's vpn. this was ok in the old server but in the new they have added 2FA. I saw this https://stackoverflow.com/a/...
nass's user avatar
  • 1,468
1 vote
1 answer
154 views

Raspberry Pi OS Google 2FA over SSH Keeps Asking For The Password and OTP

I followed this guide: https://pimylifeup.com/setup-2fa-ssh/ however this is what I get when trying to connect (it is stuck in a loop and keeps asking for the password and key): ssh [email protected]....
Jacob Miller's user avatar
0 votes
0 answers
6k views

error: PAM: User account has expired for [user] from [IP]

I am currently trying to setup libpam-google-authenticator for 2FA on a Debian 9.0 VPS. I've installed the package using apt, set it up using the google-authenticator command and connected it to a ...
Zinio's user avatar
  • 1
1 vote
1 answer
306 views

GIT client for Linux with 2fa

How can I work with GIT repositories under Linux (Debian and Ubuntu) if the repository enforces 2FA? It seems the command line GIT client does not have any support for this. GIT Desktop does not seem ...
Nimral's user avatar
  • 111
0 votes
1 answer
80 views

Can I require per-user AuthenticationMethods when switching from a non-root user to a root user?

I currently SSH into a root user from another machine with an SSH key & 2FA, so I set AuthenticationMethods publickey,keyboard-interactive. If possible, I would like to be able to SSH into a non-...
angryserver's user avatar
1 vote
1 answer
459 views

SFTP dual authentication with batchfile

I'm trying to connect to a server where dual authentication (publickey,password) is enabled. I'm using sshpass to provide password to automate the script, but when I have batchfile with SFTP, ...
Aravind's user avatar
  • 1,619
1 vote
1 answer
655 views

systemd-homed with FIDO2 - Login from tty still possible with password only

I recently tried out systemd-homed and doing that I enrolled my Yubikey as FIDO2 device. When i try to authenticate against the created home via homectl authenticate <user> it correctly ...
Simon's user avatar
  • 185
0 votes
1 answer
227 views

Enabling 2FA on Debian 10, but only for passwords (pubkey without 2FA)

I admin my private server 99% of the time from one of my own machines, using pubkey authentication. However, I have password auth enabled (for my user, not for root) for the rare cases where I need to ...
Tom's user avatar
  • 158
0 votes
0 answers
1k views

How can I separate PAM authorization for login from sudo (using Duo)?

I recently installed Duo on an Ubuntu test server using these instructions: https://duo.com/docs/duounix While 2FA authentication for login works as expected, I was not expecting every use of sudo to ...
Stonecraft's user avatar
0 votes
1 answer
1k views

FreeIpa MFA for AD users

I've setup FreeIpa POC (centos7, freeipa 4.7, two freeipa servers as multimaster with some clients). Added OTP's for several users and made it work with RADIUS for vpn access authentication purposes. ...
just_a_noob's user avatar
0 votes
1 answer
386 views

SSH 2FA for everyone but the root user | Centos 7

I am currently trying to achieve, that the root user can login with only the password, but without the 2FA authentication, when logging in from a specific Host. So far my sshd_config looks like this: #...
harrytuttle's user avatar
1 vote
2 answers
3k views

Help With Bypassing SSH 2 Factor Authentication When On Same Local Network macOS

Because of a few different applications I need to use, I need to be able to bypass Google's 2 Factor Authentication pam.d module when an SSH connection is coming from the same network. There is very ...
mcbeav's user avatar
  • 79
3 votes
0 answers
102 views

OpenSSH U2F as second factor with fallback to Google Authenticator

We use Google Authenticator for 2FA SSH logins. It's configured in /etc/pam.d/sshd as follows: @include common-password auth required pam_google_authenticator.so nullok As you may know, OpenSSH 8.2 ...
Linas Valiukas's user avatar
1 vote
0 answers
213 views

DEBIAN SSH Server with google authenticator. How to allow “publickey+2FA” for user1 and “password+2FA” for user2?

0 The problem is very simple but I'm struggling for hours without finding the good solution. I want "user1" to log in to the SSH server with publickey + 2FA code (but no password prompt, ...
MetallianFR68's user avatar
1 vote
1 answer
839 views

SSH two factor authentication

I have an account on a server that is set up for 2 factor authentication for ssh. This is terribly annoying because, even though I have ssh keys set up, I still have to type in a token code every time ...
Botond's user avatar
  • 135
1 vote
1 answer
2k views

freeRadius and google-authenticator: how do i get the qr code on a website?

I need to do a setup which I expected to be very common: Setup freeRadius, google-authenticator with an existing Active Directory to setup 2FA for Horizon View. Show the qr-code generated by google-...
markgraf's user avatar
  • 2,856
2 votes
1 answer
258 views

How to enable both Passphrase *and* Password+Yubikey as authentication method for a given user account?

Context I am lazy. But I am also (a bit) concerned with security. So on my machine (running Fedora), I want to be able to both: log into my session using a strong passphrase, log into my session ...
ebosi's user avatar
  • 295
0 votes
0 answers
353 views

Configure PAM to ask for 2FA token even if password is incorrect

I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the ...
xereeto's user avatar
0 votes
0 answers
87 views

configure ssh to allow login with ssh key (and no google 2FA) or password + google 2FA?

I'd like to configure my (debian) machine to allow ssh logins with two different options for authentication: ssh public key authentication password authentication with a (google) 2 factor ...
the Goat's user avatar
0 votes
2 answers
944 views

How can I setup two factor auth (sms) via ssh connection

I am writing a bash script on ubuntu 16.04 and I want to setup Two factor authentification via SMS on SSH connection to the server. I saw that there is a way to do it with a google authentication ...
Jospy's user avatar
  • 1
0 votes
0 answers
137 views

Why failing to setup Gmail of 2-step verification phone based in Thunderbird?

It work previously but not anymore in Fig. 1. I tried 5 times. It went through the normal Google 2-step verification process, but when returning to the main window, it gives the result in Fig. 1. I ...
Léo Léopold Hertz 준영's user avatar
7 votes
3 answers
8k views

SSH - Only require google-authenticator from outside local network

Running a debian variant (osmc) What I'm trying to do: Disable ssh through password, requiring both key and google authenticator; That's all working But now I'm trying to only require the 2 factor ...
beardedfool's user avatar
1 vote
1 answer
2k views

luks - is there 2-factor authentication

Is there anyway to achieve 2-factor authentication with luks so that if a key is compromised, if the other part is not in hand, the data is still secure?
Walter's user avatar
  • 1,234
6 votes
1 answer
3k views

i3 - locking screen with 2-factor authentication

I'm running i3 window manager and have 2-factor authentication on my system. It appears that i3 and i3lock do NOT support the additional prompt for 2-factor authentication, but merely pipes the ...
Walter's user avatar
  • 1,234
-2 votes
2 answers
1k views

How to 2-step authenticate by password + U2F Yubikey in Linux KeePassX?

I would like to have 2-step authentication by password + Fido U2F security key. I did not find any approaches which would work in Debian 8.7. The OS should not be a limiting factor here because Qt ...
Léo Léopold Hertz 준영's user avatar
3 votes
4 answers
4k views

How to use YubiKeys with SSH keys in 2-step verification?

I can setup SSH keypair without Fido U2F as described SSH-agent working over many servers without retyping? Some flag? in the thread. Two step verification would be very good: password for the ...
Léo Léopold Hertz 준영's user avatar