![\"2FA\/TOTP\"](\"https:\/\/www.servergigabit.com\/guide\/wp-content\/uploads\/2023\/11\/Modern-Digital-Marketing-Blog-Banner-300x169.jpeg\")
<\/p>\n<\/p>\n
You can enable 2FA\/TOTP on a VPS by following the instructions in this guide. Let’s address the “what” and “why” first in order to lay the groundwork for a more secure and resilient virtual environment before getting into the “how.”<\/p>\n
Two-factor authentication (2FA)<\/strong> is a security procedure that goes above and beyond password verification. It usually involves two things: something you possess (like a mobile device) and something you know (like a password).<\/p>\n Time-based One-Time Passwords (TOTP)<\/strong> symbolize a particular type of 2FA in which a unique password is created on a regular basis, typically every 30 seconds, adding a fluid and time-sensitive component to the authentication procedure.<\/p>\n There are many possible risks in the digital world, and VPS servers are no different. On your VPS, turning on 2FA\/TOTP greatly improves the security posture of your server. By themselves, passwords are vulnerable to phishing and brute force attacks. You can strengthen your defenses against unauthorized access and lower the likelihood of data breaches and possible compromises by adding an additional layer of authentication.<\/p>\n Make sure you have the following setup requirements before attempting to enable Two-Factor Authentication (2FA) with Time-based One-Time Passwords (TOTP) on your Virtual Private Server (VPS).<\/p>\n You need administrative access to your VPS and an SSH connection to your server in order to put security measures in place. Make sure you possess the authorization and rights required to modify configurations. If you are not the administrator, work with the individual or group in charge of managing the VPS.<\/p>\n Not sure if you are the root \u2013 or what a \u201croot\u201d is? No problem! We got you covered with \u201cA Practical Guide to Superuser Accounts, sudo & root<\/a>\u201d.<\/p>\n A key protocol for securely accessing and managing your virtual private server (VPS) is Secure Shell (SSH). You can download PuTTY<\/a>, a popular and trustworthy SSH client for Windows.It is important to ensure that your alternate SSH client is setup and prepared to establish a connection with your virtual private server (VPS).<\/p>\n Secure your Virtual Private Server (VPS) by configuring SSH Key Authentication first. Please see our current guide on “How to Use SSH Keys with Your Server”<\/a> for a comprehensive walkthrough on configuring SSH Key Authentication.After setting up SSH Key Authentication, come back here to proceed with configuring Two-Factor Authentication (2FA) on your VPS using Time-based One-Time Passwords (TOTP).<\/p>\n After implementing SSH Key Authentication, we can move forward with setting up and installing Time-based One-Time Passwords (TOTP) to enhance security on your VPS.<\/p>\n Installing the required packages to enable TOTP should come first. Depending on the operating system of your VPS, the precise commands might change. For instructions, consult the package manager documentation for your system.<\/p>\n Example commands for a Debian-based system:\u00a0<\/strong><\/p>\n Once the required packages are installed, configure TOTP for SSH.<\/p>\n Edit the SSH daemon configuration file, usually located at `\/etc\/ssh\/sshd_config`.<\/em><\/p>\n Ensure the following lines are present:\u00a0<\/strong><\/p>\n Save the changes and restart the SSH service:\u00a0<\/strong><\/p>\n To enhance security, disable password authentication for SSH.<\/p>\n Open the SSH configuration file again and set:\u00a0<\/strong><\/p>\n Restart the SSH service to apply the changes.\u00a0<\/strong><\/p>\n Now, let us configure the Time-based One-Time Passwords (TOTP) on your mobile device. This step ensures a seamless and secure authentication process for accessing your Virtual Private Server (VPS).<\/p>\n Begin by installing a TOTP Authenticator app on your mobile device. Google Authenticator is a popular choice, but alternatives like\u00a0Authy<\/a>\u00a0or\u00a0Microsoft Authenticator<\/a>\u00a0work just as well. Visit your device\u2019s app store:<\/p>\n \u00a0Apps for Android:\u00a0<\/strong><\/p>\n Apps for iOS:\u00a0<\/strong><\/p>\n Download and install the app.<\/p>\n 1. Open the TOTP Authenticator app.<\/p>\n 2. Tap on the option to add a new account or scan a barcode.<\/p>\n 3. On your VPS, run the following command to generate a QR code for the TOTP setup:<\/p>\n 4. Scan the QR code with your TOTP Authenticator app or manually enter the provided key.<\/p>\n Ensure you create and store backup codes as a precaution. In the unlikely event that you misplace your mobile device, these codes serve as a backup. A backup code generation prompt will appear during step 3 of the setup process. Keep these codes safe somewhere, like a physical backup or a password manager.<\/p>\n Once you’ve configured TOTP on your phone, your VPS will only allow access to users who can authenticate with their SSH keys and a time-sensitive code from your authenticator app. This greatly increases server security.<\/p>\n It is especially crucial to verify the efficacy of TOTP authentication by testing it before finishing the setup. When you try to SSH into your virtual private server (VPS), you should be asked for your SSH key and the TOTP that your authenticator app produced.<\/p>\n If successful, you have successfully configured Time-based One-Time Passwords on your VPS.<\/p>\n To complete the implementation and further secure your server, move on to the following steps.<\/p>\n After setting up Time-based One-Time Passwords (TOTP), it’s time to make sure your VPS has Two-Factor Authentication (2FA) enabled. This makes sure that in order to access your server, you need to have both the dynamic TOTP that your mobile device generates and the SSH key authentication.<\/p>\n Open your SSH configuration file, typically located at `\/etc\/ssh\/sshd_config`.<\/p>\n Make sure the following settings are configured:\u00a0<\/strong><\/p>\n Save the changes and restart the SSH service:\u00a0<\/strong><\/p>\n These settings ensure that SSH requires both public key authentication and the TOTP challenge.<\/p>\n To strengthen security further, disable password authentication entirely.<\/p>\n Confirm that the following line is present in your SSH configuration file:\u00a0<\/strong><\/p>\n Again, restart the SSH service to apply the changes.\u00a0<\/strong><\/p>\n Make sure the required ports for SSH\u2014typically port 22\u2014are open if your VPS is protected by a firewall or security group. Furthermore, make sure that traffic for the selected TOTP port\u2014typically UDP port 123\u2014is permitted by the security group or firewall. As necessary, modify these rules to conform to the unique configuration of your server.<\/p>\n After making these changes, your VPS is now requiring Time-based One-Time Passwords for Two-Factor Authentication, greatly strengthening the security posture of your server. Test access using the SSH key and the TOTP specifications to make sure the authentication process is successful.<\/p>\n Now that we’ve covered how to enable Two-Factor Authentication (2FA) on your Virtual Private Server (VPS) using Time-based One-Time Passwords (TOTP), let’s review the advantages and discuss some last ideas for boosting server security.<\/p>\n Your VPS will be well-defended against potential security threats and unauthorised access if you enable 2FA\/TOTP. A multi-layered security approach has been built by fusing the dynamic feature of TOTP with SSH key authentication. The advantages consist of:<\/p>\n You can enable 2FA\/TOTP on a VPS by following the instructions in this guide. Let’s address the “what” and “why” first in order to lay the groundwork for a more secure and resilient virtual environment before getting into the “how.” What Is 2FA\/TOTP? Two-factor authentication (2FA) is a security procedure that goes above and beyond password verification. It usually involves…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"kbtopic":[1099],"kbtag":[1243,1233],"class_list":["post-3480","kb","type-kb","status-publish","hentry","kbtopic-tutorials","kbtag-2fa-totp","kbtag-vps"],"_links":{"self":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb\/3480","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/comments?post=3480"}],"version-history":[{"count":12,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb\/3480\/revisions"}],"predecessor-version":[{"id":4392,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb\/3480\/revisions\/4392"}],"wp:attachment":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/media?parent=3480"}],"wp:term":[{"taxonomy":"kbtopic","embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kbtopic?post=3480"},{"taxonomy":"kbtag","embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kbtag?post=3480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/span>Why Do You Use 2FA\/TOTP On Your VPS?<\/strong><\/h2>\n
<\/span>Prerequisites<\/strong><\/h2>\n
<\/span>1. VPS Access<\/strong><\/h3>\n
<\/span>2. PuTTY \u2013 A Reliable SSH Client<\/strong><\/h3>\n
<\/span>Setting Up SSH Key Authentication<\/strong><\/h2>\n
<\/span>Installing and Configuring TOTP on Your VPS<\/strong><\/h2>\n
<\/span>Installing Required Packages to Enable TOTP<\/strong><\/h3>\n
sudo apt-get update<\/code><\/pre>\nsudo apt-get install libpam-google-authenticator<\/code><\/pre>\n<\/span>Configuring TOTP for SSH<\/strong><\/h3>\n
ChallengeResponseAuthentication yes\r\nAuthenticationMethods publickey,keyboard-interactive<\/code><\/pre>\nsudo service ssh restart<\/code><\/pre>\n<\/span>Securing Your SSH Configuration<\/strong><\/h3>\n
PasswordAuthentication no<\/code><\/pre>\nsudo service ssh restart<\/code><\/pre>\n<\/span>Setting Up TOTP on Your Mobile Device<\/strong><\/h2>\n
<\/span>Installing a TOTP Authenticator App<\/strong><\/h3>\n
\n
\n
<\/span>Adding Your VPS to the Authenticator App<\/strong><\/h3>\n
google-authenticator\u00a0<\/code><\/span><\/pre>\n<\/span>Generating and Saving Backup Codes<\/strong><\/h3>\n
<\/span>Testing TOTP Authentication<\/strong><\/h3>\n
ssh your_username@your_vps_ip\u00a0<\/code><\/pre>\n<\/span>Enforcing 2FA\/TOTP<\/strong><\/h2>\n
<\/span>Modifying SSH Configuration\u00a0<\/strong><\/h3>\n
ChallengeResponseAuthentication yes\r\nAuthenticationMethods publickey,keyboard-interactive\r\nPasswordAuthentication no<\/code><\/pre>\nsudo service ssh restart<\/code><\/pre>\n<\/span>Disabling Password Authentication<\/strong><\/h3>\n
PasswordAuthentication no\u00a0<\/code><\/pre>\nsudo service ssh restart\u00a0<\/code><\/pre>\n<\/span>Adjusting Security Group\/Firewall Rules\u00a0<\/strong><\/h3>\n
<\/span>Conclusion<\/strong><\/h2>\n
<\/span>Recap of the Benefits of Enabling 2FA\/TOTP\u00a0<\/strong><\/h3>\n
\n