Arch linux google authenticator 2FA

README.md

Install google authenticator

sudo pacman -S libpam-google-authenticator
sudo pacman -S qrencode

Edit pam config

sudo vim /etc/pam.d/sshd

Add to top of file below PAM-1.0 line

auth required pam_google_authenticator.so

To allow only publickey + 2fa (no password) then comment out this line

#auth      include   system-remote-login

Edit sshd config

sudo vim /etc/ssh/sshd_config

ChallengeResponseAuthentication yes
UsePAM yes

Add to bottom of file to require publickey + 2fa

AuthenticationMethods publickey,keyboard-interactive:pam

Restart SSH service

sudo systemctl restart sshd.service

Setup 2FA for user

google-authenticator