---
title: How to Implement Two-Factor Authentication (2FA) for SSH on Ubuntu and RHEL
description: Learn how to implement Two-Factor Authentication (2FA) for SSH on Ubuntu and RHEL to enhance your Linux server's security. Follow this step-by-step guide.
image: https://codenotary.com/hubfs/download%20(3).jpeg
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/AgentMon%20Start.svg) **AgentMon Start** Organization-wide AI agent spend, security and device fleet TRY NOW →](https://apps.codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 Jan 24, 2025

# How to Implement Two-Factor Authentication (2FA) for SSH on Ubuntu and RHEL

 By  [blog](https://codenotary.com/blog/author/blog)  ·   2 minute read

Two-Factor Authentication (2FA) is one of the biggest additions to the security shield for your Linux server. It does that by requiring a secondary method of authentication after entering the correct SSH password. On Ubuntu and RHEL (Red Hat Enterprise Linux), you can easily enable 2FA using Google Authenticator or libpam-google-authenticator.

This guide will show you how to implement 2FA for SSH on both systems.

![download (3)](https://codenotary.com/hs-fs/hubfs/download%20(3).jpeg?width=590&height=331&name=download%20(3).jpeg)

 

## Step 1: Install Google Authenticator

Google Authenticator is a PAM (Pluggable Authentication Module) that generates Time-based One-Time Passwords (TOTP).

Ubuntu 

sudo apt update  
 sudo apt install libpam-google-authenticator

RHEL 

sudo yum update  
 sudo yum install epel-release  
 sudo yum install google-authenticator

 

## Step 2: Configure Google Authenticator

1\. Run the following command for the user you want to secure with 2FA:

google-authenticator

2\. You will be prompted with a series of questions. Answer as follows: 

Do you want authentication tokens to be time-based? y

Do you want me to update your .google\_authenticator file? y

Do you want to disallow multiple uses of the same authentication token? y

**Do you want to increase the time window? n**

**Do you want to enable rate-limiting? y**

 

3\. A QR code and a secret key will be generated.

- Scan the QR code using your Google Authenticator app or any TOTP-compliant app such as **Authy** or **Microsoft Authenticator**.
- Save the backup codes generated for account recovery

 

## Step 3: Configure PAM to Use Google Authenticator

You need to modify the PAM SSH configuration to use Google Authenticator.

1\. Open the PAM configuration file for SSH:

sudo nano /etc/pam.d/sshd

2\. Add the following line to the top:

auth required pam\_google\_authenticator.so

 

## Step 4: Configure SSH to Use 2FA

You now need to modify the SSH configuration to enforce 2FA.

1\. Open the SSH configuration file:

sudo nano /etc/ssh/sshd\_config

2\. Find and modify the following settings:

ChallengeResponseAuthentication yes  
 PasswordAuthentication yes  
 UsePAM yes

3\. Add or modify the AuthenticationMethods directive to ensure both password and 2FA are required:

AuthenticationMethods publickey,password publickey,keyboard-interactive

 

## Step 5: Restart SSH Service

To apply the changes, restart the SSH daemon:

sudo systemctl restart sshd

 

## Step 6: Test 2FA Authentication

1\. Open a new terminal and SSH into your server:

ssh your-username@your-server-ip

2\. You should be prompted to enter your password and then a verification code from Google Authenticator.

 

## Step 7: (Optional) Enforce 2FA Only for Specific Users

To limit 2FA to specific users, modify /etc/pam.d/sshd and add the following line before pam\_google\_authenticator:

auth \[success=1 default=ignore\] pam\_succeed\_if.so user in user1:user2

Replace user1 and user2 with the usernames that should use 2FA.

 

## Troubleshooting Tips

- If SSH is locked out after configuring 2FA, use a console or recovery mode to regain access.
- Check logs for troubleshooting:

sudo tail -f /var/log/auth.log  # Ubuntu  
 sudo tail -f /var/log/secure    # RHEL

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=pinterest&media=) [![Share on email](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/email-color.png?width=35&height=35&name=email-color.png)](mailto:?subject=Check%20out%20https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=email%20&body=Check%20out%20https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel&utm_medium=social&utm_source=email)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "blog",
    "url" : "https://codenotary.com/blog/author/blog"
  },
  "dateModified" : "2025-04-01T14:55:24.433Z",
  "datePublished" : "2025-01-24T14:00:00.000Z",
  "headline" : "How to Implement Two-Factor Authentication (2FA) for SSH on Ubuntu and RHEL",
  "image" : [ "https://codenotary.com/hubfs/download%20(3).jpeg" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "blog" ],
    "url" : "https://codenotary.com/blog/author/blog"
  },
  "datePublished" : "2025-01-24T14:00:00+0000",
  "description" : "Learn how to implement Two-Factor Authentication (2FA) for SSH on Ubuntu and RHEL to enhance your Linux server's security. Follow this step-by-step guide.",
  "headline" : "How to Implement Two-Factor Authentication (2FA) for SSH on Ubuntu and RHEL",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/download%20%283%29.jpeg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/how-to-implement-two-factor-authentication-for-ssh-on-ubuntu-and-rhel"
}
```