STEP 1: HAVE AN AUTHENTICATOR APP ON YOUR PHONE
Installing and configuring required packages
apt-get install libpam-google-authenticator
Configuring PAM SSH module
vim /etc/pam.d/sshd
ADD TO TOP (after @include common-auth):
auth required pam_google_authenticator.so
Configuring SSH Service
vim /etc/ssh/sshd_config
CHANGE:
ChallengeResponseAuthentication yes
ADD (if you want public_key ONLY) :
AuthenticationMethods publickey,keyboard-interactive
RESTART SSH:
systemctl restart sshd.service
Running the Google Authenticator
Run to create OTP code:
google-authenticator
Make tokens “time-base””: yes
Update the .google_authenticator file: yes
Disallow multiple uses: yes
Increase the original generation time limit: no
Enable rate-limiting: yes
