For a more secure terminal (SSH) environment, you can add a second factor to authenticate a user. I personally run Ubuntu and i implemented the Google Authenticator on my Ubuntu system using the Authenticator Library of Google in combination with my iPhone with the Google Authenticator App. Implementation is quite simple, simply follow the instructions down below and make sure that you store the generated emergency keys somewhere safe!!
1. Login to your system running Ubuntu as the user you want to authenticate with a second factor. Make sure this user has sufficient sudo rights.
2. Install the Google Authenticator library
user@server:~$ sudo apt-get install libpam-google-authenticator
3. After installing run the Google Authentication binary
A QR-code is generated together with a secret key ad several emergency keys. Make sure you store these keys somewhere safe!!
Your new secret key is: HLWRXFRGYHUIJNB
Your verification code is 871635
Your emergency scratch codes are:
4. Scan the presented QR-code with your Google Authenticator app (see instructions on your smartphone)
5. Answer the following questions the way you prefer it for your system
Do you want me to update your "~/.google_authenticator" file (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y
6. Edit /etc/pam.d/sshd to activate the Google Authenticator while logging in through SSH
user@server:~$ vi /etc/pam.d/sshd
7. Add the following line at the bottom of the file and safe the file
auth required pam_google_authenticator.so
8. Edit /etc/ssh/sshd_config and enable the ChallengeResponseAuthentication directive
user@server:~$ vi /etc/ssh/sshd_config
Change the following directive from ‘no’ to ‘yes’ and safe the file
9. Restart the SSH daemon
user@server:~$ sudo /etc/ssh/ssh restart
Afther giving in your username/password your system will now ask you for your Google Authenticator token!