Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
On an Ubuntu VPS, the safest straightforward SSH MFA design is to require an SSH public key first and a PAM-validated TOTP code second. Install libpam-google-authenticator, add its PAM rule, enable keyboard-interactive authentication, set AuthenticationMethods publickey,keyboard-interactive, and leave password authentication disabled. Enroll and test every account before closing your recovery session.
What SSH multi-factor authentication actually requires
SSH MFA is not a single switch. It is an ordered sequence of authentication methods. In the Ubuntu design covered here, the SSH public key is factor one and a time-based one-time password (TOTP) entered through PAM is factor two.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe key part of the configuration is:
AuthenticationMethods publickey,keyboard-interactiveThe comma means that both methods in that list must succeed, in that order. The server first validates the public key, then starts a keyboard-interactive exchange. PAM supplies the second exchange and asks for the code generated by the user’s authenticator application. Because PasswordAuthentication no is also set, a password cannot replace either factor.
This is different from merely enabling a one-time code prompt. If password authentication remains available, an attacker may still be able to use a stolen password without the intended key requirement. The procedure below deliberately implements key-plus-code authentication.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before changing SSH: prevent a lockout
Make the change from a position where you can recover. A syntax error in sshd_config, a missing PAM rule, or an account that has not enrolled a token can otherwise leave you without SSH access.
Keep two access paths open
- Open a second SSH session as an administrative account, or open your VPS provider’s out-of-band console. Do not close the original working session while you edit SSH or PAM.
- From the existing session, prove that the account you intend to protect can log in with its SSH private key. If key authentication does not work now, fix it before enforcing MFA.
- Enroll that account’s TOTP secret while you still have access. Repeat the enrollment for every user who will need SSH access.
- Only after key access and TOTP enrollment are confirmed should you make the method sequence mandatory.
Ubuntu explicitly warns that a mandatory key-and-TOTP policy can lock out users who have neither a working key nor an enrolled token. Treat the still-open session or console as your rollback path until a new, independently opened session has completed both prompts.
Install the PAM authenticator module
On Ubuntu Server, the documented PAM implementation is supplied by libpam-google-authenticator. Run:
sudo apt update
sudo apt install libpam-google-authenticatorUbuntu ships this package in the universe archive component, which receives best-effort community support rather than the same support commitment as packages in the main archive. Package behavior and defaults can therefore vary by Ubuntu release; keep that qualification in mind when reproducing the procedure on a different distribution.
Add the PAM rule used by SSH
Edit /etc/pam.d/sshd with an editor available on your server and add this authentication rule:
auth required pam_google_authenticator.soThe required control means that the PAM authentication must succeed for the SSH login to succeed. The rule is consumed when sshd performs its keyboard-interactive PAM exchange; it is not a replacement for the public-key check.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Save the file without changing the module name or the auth required control. A typo in this file can prevent all PAM-based SSH logins, which is why the recovery session must remain open.
Configure sshd to require the key, then the code
Add or verify the following directives in the active sshd configuration, normally /etc/ssh/sshd_config:
PubkeyAuthentication yes
UsePAM yes
KbdInteractiveAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive| Directive | Purpose | Important qualification |
|---|---|---|
PubkeyAuthentication yes |
Allows the SSH public-key method that supplies the first factor. | The user must already have a working authorized key. |
UsePAM yes |
Allows sshd to hand the interactive authentication exchange to PAM. | Without it, the PAM module in /etc/pam.d/sshd cannot provide the code challenge. |
KbdInteractiveAuthentication yes |
Enables the keyboard-interactive method used for the TOTP prompt. | Older Ubuntu releases use the directive name ChallengeResponseAuthentication yes instead. |
PasswordAuthentication no |
Prevents a password from becoming an alternative login method. | This recipe is key plus code, not password plus code. |
AuthenticationMethods publickey,keyboard-interactive |
Requires successful completion of the public key followed by keyboard-interactive authentication. | OpenSSH advances through the comma-separated list; both methods are required. |
Account for the Ubuntu directive-name change
Ubuntu 20.04 and earlier may use ChallengeResponseAuthentication yes where current releases use KbdInteractiveAuthentication yes. Do not enable only the newer spelling on a release that expects the older one. Check the sshd configuration manual for the installed release and ensure the directive that controls keyboard-interactive authentication is enabled.
Do not accidentally configure a different factor sequence
AuthenticationMethods publickey,keyboard-interactive is not interchangeable with a password-based recipe. The Ubuntu server configuration intentionally disables password authentication. If your policy is instead password plus TOTP, it needs a different method list and a separate security review; copying the key-mandatory configuration will not implement that policy.
Recommended Free Tools
Enroll each SSH user with a TOTP secret
Run the enrollment command as the user who will log in, not as an unrelated administrator:
google-authenticatorThe command presents an interactive setup. For the Ubuntu workflow, make these choices:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Choose time-based tokens (TOTP) when asked which token type to create.
- Allow the utility to update the user’s secret file.
- Decline token reuse so a previously accepted code cannot be replayed.
- Decline the extended time window unless you have a specific operational reason to accept a wider validity period.
- Enable rate limiting to reduce repeated guessing attempts.
- Scan the displayed QR code into a TOTP authenticator application. If scanning is unavailable, use the displayed secret to add the account manually.
The command also displays emergency scratch codes. Store them offline in a protected location that the account owner can reach during an authenticator-device failure. Do not put the secret or scratch codes in an unencrypted synchronization service. Protect the generated secret file with the same care as a private credential.
Enroll more than one administrator safely
Repeat the command separately for each account that must use SSH. A token enrollment belongs to a user; enrolling your own account does not enroll another administrator. Have each person scan their own QR code and verify a login from a fresh terminal before you disable the recovery access.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Validate the configuration before reloading SSH
Check the sshd syntax before applying the change:
sudo sshd -tIf the command reports an error, correct the configuration while the existing session remains open. Do not reload a configuration that fails this check.
You can also inspect the effective settings on systems that support the dump option:
sudo sshd -T | grep -E 'pubkeyauthentication|usepam|kbdinteractiveauthentication|challengeresponseauthentication|passwordauthentication|authenticationmethods'The output helps reveal an overriding include file or a release-specific directive name. An included configuration fragment can override a value that appears correct in the main file, so inspect the complete active configuration if the effective output does not match your intended policy.
Reload and test without losing your session
Apply the daemon changes with:
sudo systemctl try-reload-or-restart sshThis command asks systemd to reload the service when possible and restart it when necessary. Keep the old SSH session and console open.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
From a completely new terminal, connect using the key that you verified earlier. The expected sequence is:
- Your SSH client offers the private key and the server accepts the matching public key.
- After the key succeeds, sshd starts a keyboard-interactive exchange.
- The terminal asks for the verification code from the user’s authenticator application.
- The session opens only after the code is accepted.
Test a second account if more than one account was enrolled. Also test a new connection after logging out of the first test connection; an already authenticated session does not prove that a new login is using the new policy.
Troubleshoot the common failure modes
SSH accepts the key and never asks for a code
Check all of the controls that make the PAM challenge available:
- Confirm
UsePAM yes. - Confirm
KbdInteractiveAuthentication yeson current Ubuntu, orChallengeResponseAuthentication yeson older releases. - Confirm the exact
AuthenticationMethods publickey,keyboard-interactiveline is active and has not been overridden by an included configuration file. - Confirm
auth required pam_google_authenticator.sois present in/etc/pam.d/sshd. - Inspect the effective settings with
sudo sshd -Tand review the SSH service log from the still-open session.
OpenSSH offers only methods that are enabled and that are next in the configured authentication list. If keyboard-interactive authentication is disabled, or if the method list does not require it after the key, no code prompt appears.
The new connection fails immediately after the change
Use the preserved session or VPS console; do not keep retrying from the locked-out terminal. Check the sshd syntax, the PAM rule, and the effective method settings. If necessary, temporarily restore the previous working SSH settings, reload the service, enroll the affected user, and then reapply the mandatory sequence.
The user has no working key
Do not make the policy mandatory for that account yet. A user without a valid key and a completed TOTP enrollment cannot satisfy the configured sequence. Install and test the public key first, then enroll the token while an administrative recovery path is still available.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A password prompt appears instead of the code prompt
Verify that PasswordAuthentication no is effective and that the method list is the key-plus-keyboard-interactive sequence shown above. A password-plus-code design is a different policy; do not infer that a password prompt is an acceptable substitute for the configured key factor.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe code is rejected
Check that the authenticator entry belongs to the same account and server enrollment, and enter a newly generated code rather than a previously used one. Confirm that the enrollment completed successfully and that the user is using the current secret, not an old QR-code entry. If the device was lost, use a protected scratch code according to your recovery procedure and immediately replace the enrollment.
One Ubuntu release works and another does not
Compare the release-specific sshd directive names. Ubuntu 20.04 and earlier may require ChallengeResponseAuthentication, while newer releases use KbdInteractiveAuthentication. The package is also in the universe component with best-effort community support, so distribution and package-version differences should be expected and tested before a fleet-wide rollout.
Lockout-avoidance checklist
- Keep an existing SSH session or out-of-band console open.
- Confirm the target user’s public-key login before changing sshd.
- Enroll that user’s TOTP secret before requiring the method sequence.
- Store scratch codes offline and protect the secret from unencrypted synchronization.
- Run
sudo sshd -tbefore reloading. - Use
sudo systemctl try-reload-or-restart sshwhile the recovery path remains available. - Test from a new terminal and verify the key prompt is followed by the code prompt.
- Test every administrative account that will use SSH.
- Close the recovery session only after successful fresh logins have been confirmed.
TOTP versus a FIDO2 hardware key
TOTP is the procedure documented above and works with a software authenticator on a user’s existing device. OpenSSH also supports FIDO authenticator algorithms and controls for hardware-backed keys. A FIDO authenticator can require a physical touch with touch-required and can require user verification, such as a PIN, with verify-required.
| Decision factor | TOTP through PAM | FIDO2 authenticator |
|---|---|---|
| Device availability | Uses a compatible authenticator application on a phone or other enrolled device. | Requires a compatible physical security key and client/server support for the relevant FIDO algorithms. |
| Phishing resistance | The user types a short code into the SSH exchange; protect the enrollment secret and scratch codes. | Public-key credentials and user-presence or user-verification controls provide a hardware-backed alternative designed to resist phishing. |
| Lost-device recovery | Recovery depends on protected scratch codes or a controlled re-enrollment process. | Recovery normally requires a spare enrolled key or an out-of-band administrative procedure. |
| Enrollment and fleet management | Each user runs google-authenticator and scans a QR code; secrets must be protected individually. |
Each user must register compatible hardware and, where required, configure touch or PIN verification. |
| Password state | The documented recipe disables password authentication and requires key plus keyboard-interactive TOTP. | Whether passwords or another factor remain enabled depends on the separate sshd method policy you deploy. |
| Combining mandatory factors | Ubuntu documents this mandatory TOTP/HOTP sequence. | Ubuntu cautions that its mandatory TOTP/HOTP recipe has not been tested in combination with mandatory U2F/FIDO. Test any combined design with a non-production account first. |
FIDO is an alternative path, not an extra line to add blindly to the TOTP configuration. Decide which factor sequence you want, confirm that your OpenSSH client and server support it, and test enrollment, daily login, and recovery before enforcing more than one mandatory second-factor system.
Operational guidance after rollout
Manage enrollment as a lifecycle
Record which accounts have completed key and token enrollment, without copying their secrets into a central plaintext document. When a user changes devices, use the existing authenticated access or the out-of-band console to perform a controlled re-enrollment. Remove old authenticator entries after the replacement has been verified.
Separate normal access from recovery access
A recovery console or a second administrative session is an operational safeguard, not a bypass to leave permanently exposed. Restrict console access to the VPS control plane, protect administrative keys, and close temporary sessions after normal MFA logins work.
Roll out in stages
Start with a non-production account or a staging VPS. Verify the exact Ubuntu release, package availability, sshd directive names, PAM behavior, and client prompts. Then protect one production administrator, test a fresh login, and expand to the remaining accounts. Staged rollout is especially important if you plan to combine TOTP with FIDO because Ubuntu does not document that combination as tested.
What a successful setup looks like
A correct deployment has all of these properties at once: every intended user has a working SSH key; every intended user has enrolled a TOTP secret; sshd has PAM and keyboard-interactive authentication enabled; password authentication is disabled; and the effective method list is publickey,keyboard-interactive. A fresh connection proves the policy by accepting the key first and then requesting the one-time code. Until that sequence works from a new terminal, keep the recovery path open.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
