2FA setup for Ubuntu

STEP 1: HAVE AN AUTHENTICATOR APP ON YOUR PHONE


Installing and configuring required packages

apt-get install libpam-google-authenticator

Configuring PAM SSH module

vim /etc/pam.d/sshd

ADD TO TOP (after @include common-auth):

auth required pam_google_authenticator.so

Configuring SSH Service

vim /etc/ssh/sshd_config

CHANGE:

ChallengeResponseAuthentication yes

ADD (if you want public_key ONLY) :

AuthenticationMethods publickey,keyboard-interactive

RESTART SSH:

systemctl restart sshd.service

Running the Google Authenticator

Run to create OTP code:

google-authenticator
Make tokens “time-base””: yes
Update the .google_authenticator file: yes
Disallow multiple uses: yes
Increase the original generation time limit: no
Enable rate-limiting: yes

Make isc-dhcp-server PXE boot into WDS

The normal Linux way for DHCP to give direction for PXE boot is :

next-server 10.10.10.10;
filename "/pxelinux.0";

However WDS takes a different approach as it does not have a pxelinux.0 file.
Instead it presents a program called wdsnbp.com.
Easy fix, we just replace the lines above with:

next-server 10.10.10.12;
filename "boot\\x64\\wdsnbp.com";

Remember to restart the service :

/etc/init.d/isc-dhcp-server restart

UPDATE: Also have a look at this post to add support for UEFI:
http://tomas.solamail.no/2019/03/20/wds-uefi-bios-dhcp-options/

fdisk – force start sector 63

When you try to create a partition on newer distributions you get “out of range” error message when trying to create a new partition starting at sector 63 :

First sector (2048-2930277167, default 2048): 63

Value out of range.
To force the use of the now deprecated “dos style” :
fdisk -c=dos /dev/sda