<\/span><\/h2>\n\n\n\nFirst, log in to your Ubuntu 20.04 server via SSH as the root user:<\/p>\n\n\n\n
ssh root@IP_Address -p Port_number<\/pre>\n\n\n\nYou will need to replace ‘IP_Address’ and ‘Port_number’ with your server\u2019s respective IP address and SSH port number. Additionally, replace ‘root’ with the username of the admin account if necessary.<\/p>\n\n\n\n
Before starting, you have to make sure that all Ubuntu OS packages installed on the server are up to date. You can do this by running the following commands:<\/p>\n\n\n\n
apt-get update -y\napt-get upgrade -y<\/pre>\n\n\n\n<\/span>Step 2: Install Google Authenticator<\/span><\/h2>\n\n\n\nWe will use Google Authenticator for multi-factor authentication. So, you will need to install the Google Authenticator PAM module to your system. You can install it by running the following command:<\/p>\n\n\n\n
apt-get install libpam-google-authenticator -y<\/pre>\n\n\n\nOnce the package has been installed, run the Google Authenticator using the following command:<\/p>\n\n\n\n
google-authenticator<\/pre>\n\n\n\nDuring the installation, you will be asked the following question:<\/p>\n\n\n\n
Do you want authentication tokens to be time-based (y\/n) y\nWarning: pasting the following URL into your browser exposes the OTP secret to Google:\n https:\/\/www.google.com\/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth:\/\/totp\/root@ubuntu2004%3Fsecret%3D4XXQ2QA6FRV72SDM2JWSZTQJE4%26issuer%3D\n<\/pre>\n\n\n\nPress y<\/strong> and hit Enter<\/strong> to continue. You should see a QR code in the following screen:<\/p>\n\n\n\n <\/figure>\n\n\n\nAnswer all questions and hit Enter<\/strong> to finish the process as shown below:<\/p>\n\n\n\nDo you want to disallow multiple uses of the same authentication\ntoken? This restricts you to one login about every 30s, but it increases\nyour chances to notice or even prevent man-in-the-middle attacks (y\/n) y\n\nBy default, a new token is generated every 30 seconds by the mobile app.\nIn order to compensate for possible time-skew between the client and the server,\nwe allow an extra token before and after the current time. This allows for a\ntime skew of up to 30 seconds between authentication server and client. If you\nexperience problems with poor time synchronization, you can increase the window\nfrom its default size of 3 permitted codes (one previous code, the current\ncode, the next code) to 17 permitted codes (the 8 previous codes, the current\ncode, and the 8 next codes). This will permit for a time skew of up to 4 minutes\nbetween client and server.\nDo you want to do so? (y\/n) y\n\nIf the computer that you are logging into isn't hardened against brute-force\nlogin attempts, you can enable rate-limiting for the authentication module.\nBy default, this limits attackers to no more than 3 login attempts every 30s.\nDo you want to enable rate-limiting? (y\/n) If the computer that you are logging into isn't hardened against brute-force\nlogin attempts, you can enable rate-limiting for the authentication module.\nBy default, this limits attackers to no more than 3 login attempts every 30s.\nDo you want to enable rate-limiting? (y\/n) y\n<\/pre>\n\n\n\n