SSH Two-Factor Authentication: Lock Down Root Access

Why passwords alone fail

The strongest practical combo is SSH key plus TOTP — the key proves possession, the authenticator code proves presence:

1. Install the PAM module — sudo apt install libpam-google-authenticator on the server.
2. Enroll — run google-authenticator as your user; scan the QR into your authenticator app and SAVE the scratch codes.
3. Wire PAM — add auth required pam_google_authenticator.so to /etc/pam.d/sshd.
4. Wire sshd — set AuthenticationMethods publickey,keyboard-interactive and ChallengeResponseAuthentication yes, then restart sshd.
5. Test golden-rule style — open a NEW terminal and connect; keep the working session open until the new one proves out.

Why bother: password-only SSH is guessable, replayable and permanently brute-forced on every public IP. Server hygiene starts on a proper box — see the VPS server tiers — and user setup is in the add sudo user guide.

The strongest combo: key plus TOTP

The strongest combo: key plus TOTP. Do the change this heading names on one site first, then check it in a private browser window or in the mail client, depending on the topic. Change one setting at a time, and undo it if the result is wrong before you try the next. If you want the Jaipur desk to look with you, email support@webji.services — that mailbox is staffed 24/7 in Hindi and English. Phone +91 141 4941811 is business hours only.

Step 1: install the PAM module

install the PAM module. Do this on one site or a staging copy first, then check the public URL in a private window so cache does not hide the result. Stop if the page errors, and email support@webji.services with the step name and the exact error before you repeat it on every account. WebJi® support mail is staffed 24/7 in Hindi and English; the phone line +91 141 4941811 is business hours only.

Step 2: enroll your authenticator app

enroll your authenticator app. Do this on one site or a staging copy first, then check the public URL in a private window so cache does not hide the result. Stop if the page errors, and email support@webji.services with the step name and the exact error before you repeat it on every account. WebJi® support mail is staffed 24/7 in Hindi and English; the phone line +91 141 4941811 is business hours only.

Step 3: sshd_config changes

How this plays out with publickey plus keyboard-interactive: settings that look cosmetic usually decide page speed and uptime under real traffic. The defaults WebJi® ships are tuned for Indian network conditions, and support can review your setup on request.

Step 4: test before closing your session

test before closing your session. Do this on one site or a staging copy first, then check the public URL in a private window so cache does not hide the result. Stop if the page errors, and email support@webji.services with the step name and the exact error before you repeat it on every account. WebJi® support mail is staffed 24/7 in Hindi and English; the phone line +91 141 4941811 is business hours only.

Locked out? Console recovery and fail2ban pairing

Locked out anyway? The recovery ladder: one — scratch codes, the one-time codes stored at enrollment; two — the kept-open session you preserved during setup (this is why the golden rule exists); three — the provider's out-of-band console (VPS panels ship a VNC/serial console that bypasses SSH entirely), which lets you comment the PAM line and back in.

Fail2ban pairs naturally with TOTP: rate-limit repeated failures so brute-force noise never reaches the second factor. Document your recovery path before you need it — a 2FA setup without a tested recovery route is a future lockout with extra steps, not a security control.