How to Configure Linux PAM (Pluggable Authentication Modules) for Two-Factor Authentication

The Password Vulnerability

In a modern Linux server environment, relying solely on a password for SSH access is incredibly dangerous. If a developer uses a weak password, or if their password is compromised in a third-party data breach, a hacker can easily SSH into your production database server and gain root access. To secure a server, you must enforce Two-Factor Authentication (2FA), requiring both “something you know” (the password) and “something you have” (a temporary 6-digit code from a smartphone app like Google Authenticator or Authy).

To implement this in Linux, we use PAM (Pluggable Authentication Modules). PAM is the central nervous system for authentication in Linux. It allows system administrators to easily “plug in” new authentication methods (like fingerprint readers, LDAP, or Time-Based One-Time Passwords) without modifying the source code of the application (like OpenSSH or the sudo command).

Step 1: Installing the Google Authenticator PAM Module

First, we must install the specific PAM module that understands the TOTP (Time-Based One-Time Password) algorithm.

On Ubuntu/Debian:

sudo apt-get update
sudo apt-get install libpam-google-authenticator

On RHEL/CentOS/Rocky Linux:

sudo dnf install epel-release
sudo dnf install google-authenticator

Step 2: Generating the TOTP Secret Key

Every user who needs to log into the server must generate their own unique cryptographic secret. As the user you wish to secure, run the following command in the terminal:

google-authenticator

The program will ask you a series of configuration questions:

1. Do you want authentication tokens to be time-based (y/n): Press y.
2. The terminal will print a massive QR code. Open the Google Authenticator (or Authy) app on your smartphone and scan it. It will also print emergency scratch codes—save these in a secure password manager.
3. Do you want me to update your “/home/username/.google_authenticator” file? (y/n): Press y. (This saves the secret key to your home directory).
4. Do you want to disallow multiple uses of the same authentication token? (y/n): Press y. (This prevents replay attacks).
5. By default, a new token is generated every 30 seconds… Do you want to do so? (y/n): Press n to keep the strict 3-token window, or y if your smartphone clock is slightly desynchronized.
6. Do you want to enable rate-limiting? (y/n): Press y. (This blocks brute-force guessing attacks).

Step 3: Configuring the SSH Daemon for PAM

Now that the user has a secret key, we must tell the SSH daemon to actually ask PAM for a 2FA code.

Edit the OpenSSH configuration file:

sudo nano /etc/ssh/sshd_config

Locate the following two lines and ensure they are set to yes:

UsePAM yes
ChallengeResponseAuthentication yes

(Note: On newer versions of Ubuntu, ChallengeResponseAuthentication has been renamed to KbdInteractiveAuthentication yes).

Save the file and restart the SSH daemon:

sudo systemctl restart sshd

Step 4: Modifying the PAM Stack

The final and most critical step is modifying the specific PAM configuration file for the SSH service. This tells Linux exactly how to authenticate an SSH login.

Edit the PAM SSH configuration:

sudo nano /etc/pam.d/sshd

Scroll to the very bottom of the file and append this exact line:

auth required pam_google_authenticator.so

Crucial Warning: Do NOT close your current SSH session yet. If you made a typo, you will lock yourself out of the server permanently.

Step 5: Testing the Configuration

Leave your current root SSH session open. Open a brand new terminal window on your laptop and attempt to SSH into the server.

ssh username@your_server_ip

The server should first prompt you for your standard password. Once you enter it correctly, PAM will intercept the login process and prompt you for the Verification code:.

Open the app on your phone, type the 6-digit number, and press Enter. You will be successfully logged in. If an attacker steals your password, they will be violently rejected at the Verification Code prompt, ensuring your server remains impenetrable.