How to set up SSH two-factor authentication for Raspberry Pi

BUY A RASPBERRY PI
--------------

READ OUR BOOKS & MAGAZINES
--------------

GET HELP WITH YOUR RASPBERRY PI
--------------

FOLLOW US
--------------

SUPPORT RASPBERRY PI FOUNDATION
--------------

#RaspberryPi

[JohnBrown-qusy]

For a while now on most Debian based systems just Sudo apt will work you don't need apt-get. It will most likely be deprecated in the future.

[lookslikerain]

Superb i set this up in less time it took to watch the video, excellent instructions very clear and it worked first time, cheers

[williamevans]

This video is brilliant. Great work. I'll be two factoring all my Pis going forward

[cfpwastaken]

Oh didn't know that existed.
Cool, now I have more security.

[TheRealPembo]

If the SSH service is disabled, would it not be easier to modify the config file PRIOR to enabling it?

[TheSenderj]

Great video, thank you. I am just wonder if there is a way to request for authentication code only when ssh is used remotely (via internet) but not required via home lan? Please help.

[dsdlonyer]

Excellent guide, thank you very much. Just set it up and works perfectly.

How this compares to using an ssh-key? Would an authorized key need a 2FA token aswell?

[abdulmuhaimin]

I switched to Authy instead of Google Authenticator, because someobe has been hacked by user.

But problem is can you install Authy on Raspberry Pi?

[Mimbultonia]

Can this be enabled via SSH ? Love to install this - but my pi is hard to access and runs headless and am using ssh to manage it. do i have to stop the SSH service before modifying the config file?

[mrecks]

How about a solution with a usb-key instead?

[BishalKashyap]

Can we use Authy Authenticator other than Google Authenticator for 2FA

[omalmannapperuma]

I already use Authy instead of Google Authenticator on my phone. If I follow all the steps in this video, and used Authy, will it work? Or do I have to install Google Authenticator on my phone for this set up to work?

[geekdroid]

Hai,
How will 2FA work for VNC Viewer?
Means will it allow to log in, or will it prompt for the passcode?
Thank You

[shaunnichols]

How do you use those codes if you lose your phone

[StefanoZamprogno]

doesn't work with pubkey auth enabled

[mihaidoboga]

This is fantastic! Thank you for this one!

[marcelbron]

The last ones to generate my authentication passwords are Microsoft and/or Google. Is there another way to do this really autonomously ?

[termile]

Cool video as always. Btw, this is a bit unrelated, but is usb boot on raspberry pi 4 official or still in beta? Thanks

[cokeforever]

it's more like a pseudo security measure... when your phone is stolen you contact your cellular provider to invalidate your old sim-card and issue you a new one, but your google account on the phone (in hands of thieves) will still be active for some time - if you deal with rpi within your router's private network - no problem (but who are you securing it from then? your kid?); however if you use real static ip address, this thing is not secure, but then again if you run a network of rpi-based surveilance or sensor devices over internet, you would do just fine with rsa-keys or even just password-auth.