Download Google Authenticator For Ubuntu
Ellen Woolcock
Linus Kendall's answer should work on older systems, but on newer Linux machines it is problematic; on my arch linux based webserver that configuration results in pam asking for my authenticator code and my password after receiving my ssh key (i.e. I need all 3).
As a side note, if you wish to have an sftp user account, you will probably need to bypass google authenticator in order to get it to work. Here is a suggestion of how to do that securely using an sftp jail. In etc/ssh/sshd_config:
Note that the nullok argument to pam_google_authenticator.so means that if a /.google_authenticator file is not found for a user, public-key authentication proceeds as normal. This is useful if I want to lock down only a subset of my accounts with 2FA.
Other Packages Related to libpam-google-authenticator
- depends
- recommends
- suggests
- enhances
- dep:libc6 (>= 2.14) [amd64] GNU C Library: Shared libraries
also a virtual package provided by libc6-udeb dep:libc6 (>= 2.17) [arm64, ppc64el] dep:libc6 (>= 2.8) [armhf, s390x] - dep:libpam0g (>= 0.99.7.1) Pluggable Authentication Modules library
- dep:libqrencode4 QR Code encoding library Download libpam-google-authenticator Download for all available architectures ArchitecturePackage SizeInstalled SizeFiles amd6432.9 kB120.0 kB [list of files] arm6430.7 kB108.0 kB [list of files] armhf29.8 kB98.0 kB [list of files] ppc64el34.4 kB188.0 kB [list of files] s390x31.2 kB112.0 kB [list of files] This page is also available in the following languages:
Although the libpam-google-authenticator is written by Google it is open source. Also, the Google Authenticator app is written by Google but does not require a Google account to work. Thanks to Sitaram Chamarty for the heads up on that.
You will be asked a few questions when you run this. You should answer in the way that suits your setup, however, the most secure options are to answer y to every question. If you need to change these later you can simply re-run google-authenticator and select different options.
Back on the server, we now need to edit the PAM (Pluggable Authentication Module) for SSH so that it uses the authenticator package we just installed. PAM is the standalone system that takes care of most authentication on a Linux server.
This is a bug in Ubuntu 18.04.1 which should be resolved when 18.04.2 is released. Universe should be enabled by default but it is not. The solution is simple, add the universe repository using the following:
sudo add-apt-repository universe
Second, installing Google Authenticator which wasn't worth a post on its own since there are a number of articles that do a decent job. But since I'm making two other points... we need to install it:
See above for the installation, now we're going to run:
google-authenticator
You're going to be asked a number of questions, answer Y to all of them (or you could read the questions if you like). When you're presented with the QR code, scan it with the Google Authenticator app on your phone.
Hi,
I just upgraded from 20.04 to 22.04 and when my screen locked after inactivity, the login screen displayed "Authentication error", I couldn't enter a password (it wasn't showing as typing), no shortcuts worked and the only power option on screen was to suspend. I can see others have had similar problems. ( -issues-after-upgrading-to-22-04-1, -login-to-ubuntu-after-upgrading-to-22-04-1-lts)
How can I fix this (hopefully without reinstalling 20.04...)