Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse an SSH key as the first factor and a PAM-validated one-time code as the second. On Ubuntu Server, install libpam-google-authenticator, enroll each account with google-authenticator, enable keyboard-interactive PAM authentication, and set AuthenticationMethods publickey,keyboard-interactive. Disable password authentication only after key login and TOTP enrollment have been verified, because the resulting policy requires both factors.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What SSH multi-factor authentication does
SSH multi-factor authentication is a sequence, not a single replacement password. The recommended Ubuntu arrangement completes two different methods in order:
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Public-key authentication: the client proves possession of the private key corresponding to a public key authorized for the account.
- Keyboard-interactive PAM authentication: the SSH server asks PAM to validate a time-based or counter-based one-time code.
The sequence is expressed in sshd_config as:
AuthenticationMethods publickey,keyboard-interactiveIn an AuthenticationMethods list, the comma means every method in that list must succeed. The key therefore has to be accepted before the PAM challenge is offered. A user who has only a password, only an SSH key, or only an authenticator code cannot complete this policy.
Ubuntu’s documented design also sets PasswordAuthentication no. That makes the public key the first factor, the TOTP or HOTP code the second, and ordinary password authentication unavailable. Do not copy that setting if your actual design is password-plus-code rather than key-plus-code; those are different policies.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How the authentication order affects users
The order matters operationally. A client may have several authentication methods available, but OpenSSH advances through the configured sequence and offers only a method that is enabled and next in that sequence. With publickey,keyboard-interactive, a valid code cannot substitute for a missing key, and a valid key alone cannot finish the login.
This arrangement also explains why a code prompt may not appear immediately. The client first offers a private key. Only after the server accepts that factor does it start the keyboard-interactive exchange that reaches PAM. If the key is not loaded, the wrong account is selected, or the public key is absent from authorized_keys, the connection can fail before a code is requested.
Decide whether the goal is key-plus-code or password-plus-code before editing the daemon. The Ubuntu recipe described here deliberately disables ordinary password authentication. A design that keeps passwords available needs a different method sequence and a separate test plan; copying the key-mandatory settings into that design can produce an unexpected login policy.
Before changing SSH: keep a way back in
A mandatory two-factor policy can lock out an account that has not completed both prerequisites. Prepare the change in this order:
- Open a second SSH session, or keep a provider console available, before editing SSH or PAM.
- Confirm that the target account can already log in with its SSH key.
- Enroll that account’s one-time-code secret while the existing access still works.
- Keep the original session open until a completely new session has passed both factors.
- Plan enrollment for every administrator who will be subject to the policy. A user without a working key and TOTP enrollment will fail once the sequence is enforced.
Do not close the recovery session immediately after reloading the daemon. It is the safest place to correct a typo in /etc/pam.d/sshd, restore an earlier SSH configuration, or finish enrollment if the new connection fails.
Make a small change at a time. Install the package, enroll a test account, add the PAM rule, and then change the SSH method policy. A second connection lets you distinguish an authentication-policy problem from a service or network problem and prevents one bad edit from removing every administrative path.
Install the Ubuntu PAM module
Ubuntu uses the libpam-google-authenticator package for the documented TOTP/HOTP workflow. From an account with administrative privileges, run:
sudo apt update
sudo apt install libpam-google-authenticatorThe package is in Ubuntu’s universe archive component and receives best-effort community support. Package behavior and configuration labels can therefore vary with the Ubuntu release; verify the syntax used by the release running your VPS.
Installation supplies the PAM module and the google-authenticator enrollment command. It does not automatically make SSH require a code. The PAM service rule, SSH daemon settings, and per-user enrollment are all separate steps.
Add the PAM authentication rule
Edit /etc/pam.d/sshd and add this authentication rule:
auth required pam_google_authenticator.sorequired means the PAM stack must successfully validate the authenticator code. The rule is used during SSH’s keyboard-interactive exchange, not during ordinary password authentication. Keep the spelling and file path exact; a rule placed in an unrelated PAM service file will not affect SSH.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not assume that installing the package enrolls every user. PAM reads the secret associated with the account being authenticated. Each account that must log in through SSH needs its own enrollment, and each account should have a recovery plan for lost or replaced authenticator devices.
Configure sshd to require both factors
In the server’s SSH daemon configuration, add or verify the following directives:
PubkeyAuthentication yes
UsePAM yes
KbdInteractiveAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactiveEach line has a specific job:
| Directive | Purpose | Version or policy note |
|---|---|---|
PubkeyAuthentication yes |
Allows the public-key method that supplies factor one. | Required for the key-plus-code design. |
UsePAM yes |
Connects SSH keyboard-interactive authentication to the PAM stack, including the Google Authenticator module. | Without it, the PAM rule cannot provide the code challenge. |
KbdInteractiveAuthentication yes |
Enables the interactive exchange in which SSH asks for the one-time code. | Current Ubuntu releases use this name. |
ChallengeResponseAuthentication yes |
The older name for the interactive-authentication setting. | Ubuntu 20.04 and earlier may require this directive instead of KbdInteractiveAuthentication. |
PasswordAuthentication no |
Prevents a normal account password from satisfying authentication. | Do not use this unchanged for a password-plus-code design. |
AuthenticationMethods publickey,keyboard-interactive |
Requires successful completion of the key method followed by the interactive PAM method. | The comma-separated list is an all-methods sequence. |
If the file already contains one of these directives, edit the effective setting rather than leaving conflicting copies scattered through the file. On releases that recognize both names, use the label documented for that release and make sure the interactive method is actually enabled.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
OpenSSH describes an authentication-method list as successful only when every method in at least one configured list is completed. For this policy, the required list contains both public key and keyboard-interactive. The setting is therefore stronger than merely enabling both methods: it prevents either method from being accepted as a complete login by itself.
Enroll each SSH user with an authenticator
Run enrollment as the user who will log in, not as an unrelated administrator:
google-authenticatorThe command displays a secret and a QR code. During the prompts, the Ubuntu procedure recommends these choices:
- Select time-based tokens for a normal TOTP deployment. The module also supports counter-based HOTP tokens, but the server and authenticator must be operated consistently.
- Allow the command to update the user’s secret file.
- Disallow reuse of an already accepted token.
- Decline the extended time window unless your operations team has a specific reason to accept the additional tolerance.
- Enable rate limiting to slow repeated guesses.
Scan the QR code with a compatible TOTP authenticator application. Enter the current six-digit code when the command requests confirmation. The application then generates a fresh code on each time interval.
Recommended Free Tools
Enroll before enforcing AuthenticationMethods. Ubuntu warns that making the policy mandatory first can leave an account unable to complete the login needed to perform enrollment. For a server with several administrators, repeat the command separately for every account rather than copying one user’s secret to another account.
Protect the secret and emergency codes
The enrollment output includes emergency scratch codes. Store them offline in a controlled location where an administrator can retrieve them during device loss, but where an attacker who obtains the VPS account cannot read them. Protect the generated secret file with the same care as a private credential. Ubuntu specifically warns against placing these secrets in unencrypted synchronization services.
Scratch codes are a recovery mechanism, not a routine second factor. Record which codes have been used, restrict access to the remaining codes, and replace the enrollment after a lost device or suspected disclosure. Keep the recovery process documented before making the policy mandatory.
Repeat enrollment for every account that will be covered by the SSH policy. Enrolling one administrator does not enroll other users, even when they share the same server.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reload sshd without closing your recovery session
Apply the daemon configuration with:
sudo systemctl try-reload-or-restart sshThis command attempts a reload and can restart the service when necessary. Leave the existing SSH connection untouched. From a new terminal, connect using the account’s private key. The expected interaction is:
- The client offers the authorized SSH key.
- The server accepts the key as the first method.
- SSH presents a keyboard-interactive prompt.
- You enter the current code from the authenticator application.
- The session opens only after both methods succeed.
Test from a genuinely new connection rather than assuming that an already authenticated shell proves the new policy works. If the test fails, use the still-open session or provider console to inspect the SSH settings and PAM rule before attempting another reload.
Test every affected administrative account, not just the account used to edit the files. A successful test for one user proves that user’s key and secret work; it does not prove that another user’s key is authorized or that the other user completed enrollment.
Troubleshoot the common failure modes
SSH accepts the key but never asks for a code
Check all of the links in the method chain:
- Confirm that
UsePAM yesis active. - Confirm that
KbdInteractiveAuthentication yesis enabled on newer Ubuntu releases, or thatChallengeResponseAuthentication yesis enabled on older releases. - Confirm that
AuthenticationMethods publickey,keyboard-interactiveis present and spelled exactly. - Confirm that the PAM line appears in
/etc/pam.d/sshd. - Confirm that the daemon was reloaded after both files were changed.
OpenSSH offers only methods that are enabled and that are next in the configured authentication list. If the interactive method is disabled, or if the method sequence is absent, a successful key exchange can end the login without a code prompt.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The user is asked for a password instead
A password prompt indicates a different policy from the key-plus-code recipe, an overriding configuration, or an authentication method that remains enabled. Decide first whether you want password-plus-code or key-plus-code. For the documented key-plus-code policy, the public key must be first, keyboard-interactive must be available for PAM, and ordinary password authentication is disabled.
The account is locked out after enforcement
Do not repeatedly retry from the same terminal. Return to the second SSH session or console that you kept open. Verify that the account’s public key is still authorized, verify that the account completed google-authenticator, and correct the SSH or PAM configuration there. If the authenticator device was lost, use the protected emergency scratch codes according to your organization’s recovery procedure, then enroll a replacement device before closing the recovery path.
The code is rejected
Check that the code belongs to the same account that is logging in and that enrollment completed for that account. A secret generated for one user is not automatically valid for another. If the secret file was moved, overwritten, or synchronized through an unencrypted service, treat it as exposed and perform a controlled re-enrollment from the recovery session.
Also check whether the authenticator is producing the token type you selected. A time-based enrollment must be used as TOTP, while a counter-based enrollment requires the counter to remain synchronized. Avoid accepting a wider time window merely to hide a clock or enrollment problem; the Ubuntu procedure recommends declining the extended window unless there is a specific operational reason.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A release uses an unfamiliar directive name
Ubuntu 20.04 and earlier may use ChallengeResponseAuthentication, while newer releases use KbdInteractiveAuthentication. The setting’s purpose is the same: allow the SSH keyboard-interactive exchange that invokes PAM. Use the name recognized by the installed release rather than copying a configuration fragment blindly.
One user works and another does not
Check the second user’s public key authorization and enrollment independently. The PAM module looks up the secret for the account being authenticated, so a working administrator’s QR enrollment does not cover a colleague. Confirm that each person has a current authenticator, protected scratch codes, and a private key corresponding to a public key authorized for that account.
Lockout-avoidance checklist
Use this checklist immediately before making the method sequence mandatory:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Second SSH connection or out-of-band console is open.
- Key-based login has been tested for each affected account.
- TOTP enrollment has completed for each affected account.
- QR secrets and scratch codes are stored securely and are not in unencrypted synchronization storage.
- The PAM rule is in
/etc/pam.d/sshd. - The interactive-authentication directive matches the Ubuntu release.
AuthenticationMethodsrequires the factors you actually intend to enforce.- A new connection has passed key authentication and the code prompt.
- The recovery session remains available until the test is complete.
After a successful test, retain at least one documented recovery route. Revisit it whenever an administrator changes devices, an SSH client is replaced, or the server is upgraded to a release with different directive naming.
TOTP compared with a FIDO2 security key
A one-time-code application is not the only way to add a second factor. OpenSSH documents FIDO authenticator algorithms and controls that can require physical presence or a local user-verification step. A FIDO2 security key is an alternative path, not an extra requirement to layer onto the Ubuntu TOTP recipe without testing.
| Decision factor | TOTP with PAM | FIDO2 security key |
|---|---|---|
| Where the factor lives | An authenticator application and the account’s PAM secret. | A hardware-backed authenticator handled by an OpenSSH-supported client and server. |
| Phishing resistance | Codes can be typed into a convincing but hostile prompt, so users must still identify the server correctly. | Designed to bind authentication to the registered origin and can provide stronger resistance to phishing. |
| Physical interaction | No USB or NFC key is required; the user reads a rotating code. | touch-required can require physical touch, and verify-required can require user verification such as a PIN. |
| Lost-device recovery | Recovery depends on protected scratch codes or a controlled re-enrollment. | Recovery requires a spare registered key or an administrative replacement process. |
| Deployment burden | Users enroll a QR secret and maintain an authenticator application. | Fleet management must cover key procurement, registration, replacement, and client compatibility. |
| Password setting | The documented key-plus-TOTP design disables password authentication. | Password behavior depends on the separate SSH policy you configure. |
| Combining both methods | Ubuntu cautions that its mandatory TOTP/HOTP recipe has not been tested in combination with mandatory U2F/FIDO. | Test any combined mandatory policy with a non-production account before applying it to administrators. |
Choose TOTP when users already have a supported authenticator application and you need a straightforward PAM enrollment process. Choose FIDO2 when hardware-backed credentials, physical-presence checks, or stronger phishing resistance justify the additional key-management work. In either case, document recovery before enforcement.
OpenSSH exposes the FIDO controls as part of its supported authenticator configuration. touch-required asks for a physical touch, while verify-required asks the authenticator to perform user verification such as a PIN. These controls address different requirements, so decide whether presence, verification, or both are required. Confirm client and server support before registering keys for production users.
Free tools Windows power users keep installed
One-click scans. No signup required.
Operational limits and support expectations
The Ubuntu package is community-supported on a best-effort basis through the universe component. Treat the exact package version, directive names, and integration behavior as distribution- and release-dependent. Keep a test account and a recovery channel for upgrades, configuration changes, and authenticator replacement.
Do not assume that adding a second factor automatically improves every existing access path. Review automation, configuration-management jobs, monitoring agents, and emergency accounts separately. Any process that cannot complete both methods will stop working when the sequence becomes mandatory, so give it an explicitly designed authentication path rather than weakening the interactive policy for everyone.
Plan the operational ownership of enrollment and recovery. Someone must be able to issue a replacement secret, control scratch-code access, and verify that a departing administrator no longer has an authorized key or usable second factor. The SSH policy protects interactive logins only when both the key inventory and the PAM enrollment records are maintained.
Frequently asked questions
Can I use only an authenticator code without an SSH key?
Not with the recommended configuration. AuthenticationMethods publickey,keyboard-interactive requires the public key first and the PAM-validated code second. A password-only account, key-only account, or code-only account cannot satisfy both methods.
Why did installing the package not create an MFA prompt?
Package installation supplies the PAM implementation, but the SSH service still needs the PAM rule, UsePAM yes, an enabled keyboard-interactive method, and the comma-separated AuthenticationMethods policy. The user also needs to run google-authenticator and scan the resulting QR code.
Should I disable passwords before enrollment?
No. Verify the SSH key and complete TOTP enrollment first, while a second session or console remains available. Disabling passwords and enforcing both methods too early can lock out an account that has not completed enrollment.
What happens if a phone with the authenticator app is lost?
Use the protected emergency scratch codes through the organization’s recovery process, then enroll a replacement device. If the secret may have been exposed, treat it as compromised and perform controlled re-enrollment rather than continuing to rely on it.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Is FIDO2 automatically compatible with the Ubuntu TOTP setup?
No. Ubuntu cautions that its mandatory TOTP/HOTP configuration has not been tested in combination with mandatory U2F/FIDO. Test a combined policy with a non-production account and verify OpenSSH client and server support before enforcing it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which Ubuntu directive should I use for keyboard-interactive authentication?
Current releases use KbdInteractiveAuthentication yes. Ubuntu 20.04 and earlier may use ChallengeResponseAuthentication yes. Use the name recognized by the release installed on the VPS and ensure that PAM is enabled.
Final decision
For an Ubuntu Linux VPS, the safest documented rollout is: verify key access, enroll TOTP, add the PAM rule, enable keyboard-interactive PAM authentication, require publickey,keyboard-interactive, disable ordinary passwords, reload SSH, and prove the two-step login from a new session while a recovery path remains open.
Frequently Asked Questions
Can I use only an authenticator code without an SSH key?
Not with the recommended configuration. AuthenticationMethods publickey,keyboard-interactive requires the public key first and the PAM-validated code second.
Why did installing the package not create an MFA prompt?
Installation supplies the PAM module, but SSH also needs the PAM rule, UsePAM yes, keyboard-interactive authentication enabled, the method sequence configured, and per-user TOTP enrollment.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Should I disable passwords before enrollment?
No. Confirm key access and complete enrollment first while a second session or console remains available. Enforcing both methods too early can lock out the account.
What if the authenticator phone is lost?
Use protected emergency scratch codes through your recovery procedure, then enroll a replacement device. Re-enroll immediately if the old secret may have been exposed.
Is FIDO2 automatically compatible with this TOTP setup?
No. Ubuntu cautions that mandatory TOTP/HOTP has not been tested together with mandatory U2F/FIDO. Test combined policies with a non-production account.
Which directive enables keyboard-interactive authentication?
Current Ubuntu releases use KbdInteractiveAuthentication yes; Ubuntu 20.04 and earlier may use ChallengeResponseAuthentication yes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe Bottom Line
Require both factors with AuthenticationMethods publickey,keyboard-interactive, enroll every user before enforcement, keep a recovery session open, and test a new SSH connection before closing your fallback path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
