How to Enable Google Authenticator 2FA in Ubuntu 24.04

Two-factor authentication (2FA) adds an extra layer of security to your Ubuntu system. Instead of just using a password, you’ll also need a special code from your phone to log in. This guide will show you how to set up Google Authenticator on Ubuntu 24.04 step by step.

What is Two-Factor Authentication?

Two-factor authentication means you need two things to log in: something you know (your password) and something you have (your phone). Even if someone steals your password, they can’t access your system without your phone.

What You’ll Need

Before we start, make sure you have:

• Ubuntu 24.04 system with admin access
• A smartphone with Google Authenticator app installed
• Internet connection

Step 1: Install Google Authenticator

First, we need to install the Google Authenticator package on your Ubuntu system. Open your terminal and run these commands:

sudo apt update
sudo apt install libpam-google-authenticator

This will download and install the necessary files for Google Authenticator to work with your system.

Step 2: Set Up Google Authenticator for Your User

Now we’ll configure Google Authenticator for your user account. In the terminal, type:

google-authenticator

The system will ask you several questions. Here’s what to choose:

Question 1: “Do you want authentication tokens to be time-based?”

Answer: y (yes)

After answering yes, you’ll see a QR code on your screen. Keep this terminal window open – we’ll need it in the next step.

Step 3: Scan the QR Code

On your smartphone:

1. Open the Google Authenticator app
2. Tap the “+” button to add a new account
3. Choose “Scan a QR code”
4. Point your camera at the QR code in your terminal

Your phone will now show a 6-digit code that changes every 30 seconds. Write down the backup codes shown in your terminal – you’ll need them if you lose your phone.

Step 4: Answer the Remaining Questions

Back in your terminal, continue answering the questions:

Question 2: “Do you want me to update your /home/username/.google_authenticator file?”

Answer: y (yes)

Question 3: “Do you want to disallow multiple uses of the same authentication token?”

Answer: y (yes) – This prevents someone from using the same code twice

Question 4: “By default, tokens are good for 30 seconds…”

Answer: n (no) – Keep the default 30-second window

Question 5: “Do you want to enable rate-limiting?”

Answer: y (yes) – This protects against brute force attacks

Step 5: Configure SSH to Use 2FA

Now we need to tell your system to ask for the Google Authenticator code when someone tries to log in via SSH. Edit the SSH configuration file:

sudo nano /etc/pam.d/sshd

Add this line at the end of the file:

auth required pam_google_authenticator.so

Save and close the file by pressing Ctrl+X, then Y, then Enter.

Step 6: Enable Challenge Response Authentication

Edit the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Look for the line that says ChallengeResponseAuthentication. You might find one of these situations:

If you find this line:

ChallengeResponseAuthentication no

Change it to:

ChallengeResponseAuthentication yes

If you find this line (with # at the beginning):

#ChallengeResponseAuthentication yes

Remove the # to uncomment it:

ChallengeResponseAuthentication yes

If you don’t find the line at all:

Add this line anywhere in the file (just after other authentication settings – Do not add this line at the end of the file as it will not work):

ChallengeResponseAuthentication yes

Next, look for the UsePAM line. If you find:

UsePAM no

Change it to:

UsePAM yes

If the line doesn’t exist, add:

UsePAM yes

Save and close the file by pressing Ctrl+X, then Y, then Enter.

Step 7: Restart SSH Service

Restart the SSH service to apply the changes:

sudo systemctl restart sshd

Step 8: Test Your Setup

Important: Before closing your current terminal, open a new terminal window to test the setup. This way, if something goes wrong, you still have access to fix it.

Try to SSH into your system from another terminal or computer:

ssh your-username@your-server-ip

You should see prompts for:

1. Your regular password
2. Your verification code (from Google Authenticator app)

Enter the 6-digit code from your Google Authenticator app when asked.

Troubleshooting Common Issues

Can’t Log In After Setup

If you get locked out, you can disable 2FA temporarily:

sudo nano /etc/pam.d/sshd

Comment out the Google Authenticator line by adding # at the beginning:

#auth required pam_google_authenticator.so

Then restart SSH:

sudo systemctl restart sshd

Lost Your Phone?

Use one of the backup codes you saved earlier. Each backup code can only be used once.

Time Sync Issues

If codes aren’t working, make sure your server and phone have the correct time:

sudo ntpdate -s time.nist.gov

Security Tips

• Keep your backup codes in a safe place
• Don’t share your QR code or secret key with anyone
• Consider setting up 2FA for multiple users on your system
• Test your backup codes periodically to make sure they work

What’s Next?

You’ve successfully set up Google Authenticator 2FA on your Ubuntu 24.04 system. Your server is now much more secure because attackers need both your password and access to your phone to get in.

Consider enabling 2FA for other services you use, like email accounts, cloud storage, and other online services. The more you use 2FA, the safer your digital life becomes.

Remember to keep your backup codes safe and update your phone number in Google Authenticator if you change phones. With these security measures in place, you can feel confident that your Ubuntu system is well protected against unauthorized access.