Do you want authentication tokens to be time-based (y\/n) y<\/pre>\nBig QR code will be generated in your terminal. You can scan the code with the authenticator application on your Android\/iOS\/Windows phone or tablet or enter the secret key generated on the screen.<\/p>\n
Emergency scratch codes will also be generated. You can use these codes for authentication in case you lose your mobile device.<\/p>\n
Your emergency scratch codes are:\n80463533\n68335920\n89221348\n12489672\n11144603<\/pre>\nSave the authentication settings for the root user by answering YES to the next question<\/p>\n
Do you want me to update your \"\/root\/.google_authenticator\" file (y\/n) y<\/pre>\n<\/span>5.\u00a0Configure the Authenticator to Generate One-Time Passwords.<\/span><\/h2>\nNext, you can configure the authenticator to generate one-time passwords. Since they last 30 seconds, all generated passwords can be used once.<\/p>\n
Do you want to disallow multiple uses of the same authentication\ntoken? This restricts you to one login about every 30s, but it increases\nyour chances to notice or even prevent man-in-the-middle attacks (y\/n) y<\/pre>\nYou can use the next setting if you have time syncing issues across your devices, so we will not use this option<\/p>\n
By default, tokens are good for 30 seconds and in order to compensate for\npossible time-skew between the client and the server, we allow an extra\ntoken before and after the current time. If you experience problems with poor\ntime synchronization, you can increase the window from its default\nsize of 1:30min to about 4min. Do you want to do so (y\/n) n<\/pre>\nThe next setting prevents brute-force attacks. You will only have three chances per 30 seconds to enter the correct password.<\/p>\n
If the computer that you are logging into isn't hardened against brute-force\nlogin attempts, you can enable rate-limiting for the authentication module.\nBy default, this limits attackers to no more than 3 login attempts every 30s.\nDo you want to enable rate-limiting (y\/n) y<\/pre>\nNow we have the Google Authenticator application configured and the next step is to configure the authentication settings in openSSH. To do so, open the “\/etc\/pam.d\/sshd” file and add the following line to the end of the file:<\/p>\n
# vim \/etc\/pam.d\/sshd\n\nauth required pam_google_authenticator.so<\/pre>\nSave the changes, and open the “\/etc\/ssh\/sshd_config” file and enable Challenge Response Authentication.<\/p>\n
# vim \/etc\/ssh\/sshd_config\n\nChallengeResponseAuthentication yes<\/pre>\n