MFA with Googleauthenticator for EC2 Instances.

First Make sure that the server time and the mobile time as same.


root@ip-xx-xx-xx-xx:~# apt-get update
root@ip-xx-xx-xx-xx:~# apt-get upgrade

ubuntu@ip-xx-xx-xx-xx:~ sudo apt-get install libpam-google-authenticator

ubuntu@ip-xx-xx-xx-xx:~ sudo vi /etc/pam.d/sshd

At the start of the file, add the following line, then save and exit.

auth required pam_google_authenticator.so nullok


This will mean that users who don’t run Google Authenticator
initialization won’t be asked for a second authentication.
ubuntu@ip-xx-xx-xx-xx:~$ sudo vi /etc/ssh/sshd_config

PasswordAuthentication yes
ChallengeResponseAuthentication yes

wq!


ubuntu@ip-xx-xx-xx-xx:~$ google-authenticator

Do you want authentication tokens to be time-based (y/n) y

This will give a link like this , you can scan the QR code with the mobile.

https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/ubuntu@xx.xx.xx.xx

Do you want me to update your "/home/ubuntu/.google_authenticator" file
(y/n) y

your chances to notice or even prevent man-in-the-middle attacks (y/n) y

size of 1:30min to about 4min. Do you want to do so (y/n) n

Do you want to enable rate-limiting (y/n) n

sudo /etc/init.d/ssh restart



Now try to login to the server using the aws key.
jino@ndz-Satellite-C50-B:~$ ssh -i /home/jino/Downloads/mfatest.pem
ubuntu@xx.xx.xx.xx
Authenticated with partial success.
Verification code:
Password:

First one Verification code is the Google Authentication code from the
mobile. and the Password is the Password of the Ubuntu User.