The Ultimate questions on Linux, the Universe, and Everything

On any linux based server, it is possible to protect SSH with two-factor authentication using the Google Authenticator PAM module. This is actually easy to install and configure. Login to your SSH server and install the module. On Debian (or for instance Raspbian): sudo apt-get install libpam-google-authenticator On Fedora: dnf install google-authenticator Create the verification key for the user. I prefer to not allow root access to a server, so this step should be run as the user that should be able to login: google-authenticator You can answer y to most questions. Finally, you will get a QR code that can be scanned by your phone TOTP app (any standard TOTP application will do). Make sure to store the emergency codes in a safe place, such as a Keepass database or on a paper. Now you need to make a few changes, so that PAM (which is responsible for authentication on most linux systems) asks for the verification code in addition to your password when logging in thr...

Many websites and online services offer two-factor authentication (2FA) using SMS or using a Time-based One-Time Password (TOTP) application (some services also offer an email link, but I will not cover it here, although it also adds security in a similar way). It is highly recommended to use two-factor authentication to sign in to websites. It adds one layer of information besides the password, which makes signing in to online websites a bit more secure. The only way someone can get into your account is if they acquire both your password and the secret key on your phone. I prefer TOTP over SMS, because SMS is sometimes more unreliable and slower. (I won't discuss which method is more secure; there are potential vulnerabilities in both use cases depending on device and platform) Time-based One-Time Password A Time-based One-Time Password algorithm calculates a one-time password from a shared secret key and the current time. It is a standard described in RFC 6238 . It re...