Implementing Two-Factor Authentication (2FA) with SSH on Debian 11 Server

To improve the security level of your Debian 11 server, it is highly recommended to use two-factor authentication. In case, you want to implement 2FA, then here in this guide, you will get a piece of detailed information about the setup process.

Understanding Two-Factor Authentication

For entering the Debian server, usually users just fill in the PW or SSH key. Two-factor authentication makes log-in more secure because it needs 2 various pieces of information to enter the system. Together with a standard password, users are required to enter a one-time PW for log in to the Debian server. This temporary password is created by the TOTP algorithm. Nowadays, lots of platforms consider the usage of 2FA for security reasons, and it is a great idea that can significantly safeguard your server from unauthorized attempts to enter it.

Here, in this guide, we will share our practical recommendations about the process of setting up 2FA so you will have a clear understanding of the public key authentication and PW authentication. The software that will be used for 2FA is open-source and it is called libpam authenticator.

Step 1: Setting Up Google Authenticator on Debian Server

To Install the authenticator from the default repository, you should use the following command line:

sudo apt install -y libpam-google-authenticator

For the key creation, use the following command:

google-authenticator

Once you’ve done that, you will be asked whether the authentication tokens should be time-based and here you should specify Y. After that you will get a QR that should be scanned with the TOTP application on your phone. Here are 2 products that are worth using:

-       Non-open-source Google Authenticator mobile application. In case, you don’t want to use Google products, you can go for Red Hat ones and try FreeOTP.

-       Google Authenticator can be easily installed by an Apple store or Google Play on your device.

Don’t forget to enlarge the window to call the full QR with the chosen Authentication on your device. After that process is completed, you will get a 6-digit PW on your mobile device and according to the default setting this password will be changing every 30 sec. Enter it for the confirmation of your access.

In the terminal window, you will see the information about the verification code, secret key, and scratch code. It is highly advisable that you save this data somewhere safe for later needs.

Then a couple of questions will be listed below this information which you should reply Y(Yes). By doing so, you are increasing the time window, updating config file of the Authenticator, enabling rate limits for the better protection, and disabling multiple users.  

Step 2: Enabling Google Authenticator for SSH Access

Using Password Authentication with 2FA

For those who are planning to use password authentication with 2FA. Here is a short instruction on the entire process, start with opening the config file with:

sudo nano /etc/ssh/sshd_config

While in the file, find such parameters as ChallengeResponseAut. and UseRAM, and set both of them to yes.

PAM means a specific authentication module so it is possible to easily plug in various authentication approaches within your Debian system. To start proper Authentication with SSH, both these parameters should be enabled.

One more important parameter that should be set to Yes is PermitRootLogin. To allow the process of two-factor authentication its value should not be prohibited-PW or no, so check if everything is mentioned properly in the config file.

After saving the file with all the conducted changes, you should do the following important steps:

sudo nano /etc/pam.d/sshd

Once in the file, find the line with ChallengeResponseAuth. and also change its value to Yes. This parameter enables a proper PW authentication process.

@include common-auth

Also, don’t forget to add the following info:

auth   required   pam_google_authenticator.so

Save the file with the made changes and restart SSH using the following line:

sudo systemctl restart ssh

Once you have followed all the above-mentioned instructions, you will be asked for the verification code as well as your PW while entering the system. The verification code is one-time generated data that you will receive on your mobile device. One more recommendation to keep in mind – don’t close the current session. For the testing purposes of the process, you should open another window and in case you have any issues, then the initial SSH session will be crucial for the fixing of this problem.  

Combining Public Key Authentication with 2FA

To combine public key authentication with 2FA, here is a direct process for you to follow. Start with the opening of the config file:

sudo nano /etc/ssh/sshd_config

While in the file, you will need to find 2 parameters and set them to Yes. Search for ChallengeResponseAuthen. and UsePAM and once found change their value to the needed one.

PAM means a specific authentication module that is needed to easily plug in various methods of authentication on the Debian system. For the switching on of the Google Authenticator, both of these parameters should be enabled.

In case, you also need a root user to access two-factor authentication then also find an additional parameter that is called PermitRootLogin. Once found you should also change its value to Y(Yes), and other kind of value is inappropriate in this variant.

Once, you have completed all the above-mentioned steps, you should also add one more line to the file:

AuthenticationMethods publickey,keyboard-interactive

Close the file with all the saved changes in it. The next step will be editing the PAM rules:

sudo nano /etc/pam.d/sshd

In the file, you should find the following parameter – ChallengeResponseAuthen with Yes value. The next step will be to comment this part out because you will use the SSH key.

@include common-auth

To enable the process, the following line is highly important:

auth   required   pam_google_authenticator.so

After all the changes save the file and restart the system with the command:

sudo systemctl restart ssh

Now, when everything has been properly set up on your Debian server, you can use secure log in processes where you will enter both the verification code and SSH key. One more last reminder is – don’t close the current session. Open one more terminal window and test if everything works as required and in case of some issues you can use this initial session.

Important Considerations

-        The users of the Debian servers should definitely scan QR and run authenticator commands in order to set up everything properly. Otherwise, there will be some issues with the permission denial.

-        Don’t forget to save your scratch code. In case of an emergency when you cannot access your mobile device for whatever reason, you can use one of 5 available scratch codes to finish the process of verification. Each code can be used only once so keep that in mind.

-        To change the secret key, all you need to do is to run google-authenticator command and update this file.

-        For a smooth authentication process, you should also control the time zones. The one-time PW is generated with the current time info so it is a good idea to switch on the synchronization on the Debian server and your mobile device.

Disabling SSH Two-Factor Authentication

To start the disabling process, you should use:

sudo nano /etc/pam.d/sshd

The next step is the comment on:

auth   required   pam_google_authenticator.so

In case you added the line with AuthenticationMethods, then you should delete keyboard-interactive part. Then instead add the publickey and save the changes. The last step will be the restart of the system with:

sudo systemctl restart ssh

Final Summary

Hope this information was helpful and now you have a clear understanding of how all the processes function and how to set up everything properly. In case, some issues occur, we have also discussed a couple of recommendations to deal with the authentication troubles.