Lion Cipher Lab
Add two-factor authentication (TOTP) to SSH
- Cyber / Security Engineer
- Intermediate
- ~35 min
- Free · no account required
Why it matters
A single secret is a single point of failure. If someone steals your SSH private key off a backed-up laptop, phishes your password, or finds it in a leaked repo, that one secret is the whole door — and they walk in as you. Two-factor authentication fixes this by demanding something else as well: after your key or password, the server also asks for a short code that only your authenticator app can produce right now. An attacker who has your key but not your phone is stopped cold at the second prompt. This is the same defense your bank and email already use, applied to the most attacked…
What you'll learn
- multi-factor authentication (MFA/2FA)
- TOTP and authenticator apps
- the Linux PAM authentication stack
- editing /etc/pam.d/sshd
- sshd_config AuthenticationMethods
- requiring key + one-time code together
- avoiding SSH lockout
- saving and using backup codes
Steps in this lab
- What 2FA and TOTP mean, and why put them on SSH
- Read this first: do not lock yourself out
- Install the Google Authenticator PAM module
- Create your secret: run the setup, scan the QR, and SAVE the backup codes
- Wire the module into SSH's PAM stack
- Tell sshd to demand key AND code — sshd_config
- Validate, restart, and TEST from a SECOND session
- What you gained — and where 2FA still ends