Two-Factor Authentication for Linux Login

Linux Security

Add 2FA to your Linux desktop for enhanced security.

This guide covers setting up Google Authenticator for:

Prerequisites

Keep a root terminal open while configuring. If something goes wrong, you could lock yourself out.

sudo apt update
sudo apt install libpam-google-authenticator -y

Run the setup as your normal user (not root):

google-authenticator

Answer the prompts:

Scan the QR code with your authenticator app and save the emergency backup codes.

Edit the GDM PAM configuration:

sudo vim /etc/pam.d/gdm-password

Add this line at the very top of the file:

auth required pam_google_authenticator.so

We use required without nullok to enforce 2FA for all users.

Edit the login PAM configuration:

sudo vim /etc/pam.d/login

Add this line at the very top of the file:

auth required pam_google_authenticator.so

This protects console logins (Ctrl+Alt+F2, etc.).

Restart GDM to apply (this will log you out):

sudo systemctl restart gdm

This applies to:

If you're locked out, boot into recovery mode:

Remove the 2FA line from PAM configs:

nano /etc/pam.d/gdm-password
nano /etc/pam.d/login

TOTP codes are time-sensitive. If codes aren't working:

sudo apt install ntp
sudo systemctl enable ntp
sudo systemctl start ntp

Each user needs to run google-authenticator individually to set up their own 2FA.

Required vs nullok: Using required means 2FA is mandatory. With nullok, users without 2FA configured can still log in with just a password.
Backup codes: Store your emergency backup codes securely offline.
Recovery: Always have a backup way to access your system (recovery mode, live USB, etc.).