How to Enable MFA on Kali Linux SSH (Practical and Secure Guide)

Want to protect Kali Linux SSH with MFA? In this guide, you will configure two-factor authentication for SSH, reduce unauthorized access attempts, and improve the security of your lab.

Step 1 — Installing Google PAM

In this step, we will install and configure Google PAM.

PAM, which stands for Pluggable Authentication Module, is an authentication framework used on Linux systems to authenticate users. Since Google created an OATH-TOTP app, they also built a PAM module that generates TOTPs and is fully compatible with any OATH-TOTP app, such as Google Authenticator or MS Authenticator.

First, update the Kali repository cache:

┌──(kali㉿kali)-[~]
└─$ sudo apt update

Next, install the PAM module.

┌──(kali㉿kali)-[~]
└─$ sudo apt install libpam-google-authenticator -y

With the PAM module installed, we will use a helper app that comes with it to generate a TOTP key for the user you want to add a second factor for. This key is generated per user, not system-wide. That means each user who wants to use a TOTP authenticator app will need to log in and run the helper app to get their own key; you cannot simply run it once to enable it for everyone (although there are some tips at the end of this tutorial for setting up or requiring MFA for many users).

Run the initialization app.

┌──(kali㉿kali)-[~]
└─$ google-authenticator

After running the command, you will be asked a few questions. The first is whether the authentication tokens should be time-based.

This PAM module supports either time-based or sequential tokens. Using sequential tokens means the code starts at a specific point and then increments after each use. Using time-based tokens means the code changes automatically after a set period. We will choose time-based tokens because that is what apps like Google Authenticator expect, so answer y for yes.

After answering this question, a lot of output will scroll across the screen, including a large QR code. At this point, use your authenticator app on your phone to scan the QR code, or manually enter the secret key. If the QR code is too large to scan, you can use the URL above the QR code to get a smaller version. Once added, you will see a six-digit code in your app that changes every 30 seconds.

Add the new account to your app; I will use Microsoft Authenticator:

Enter code from app (-1 to skip): 704054

At this prompt, enter the code generated by Authenticator. It will then return your backup codes; save them in a secure location:

Do you want me to update your "/home/kali/.google_authenticator" file? (y/n) 
y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n)
y

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n)
n

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n)
y

Step 2 — Configuring OpenSSH

To get started, open the sshd configuration file for editing using nano or your favorite text editor.

┌──(kali㉿kali)-[~]
└─$ sudo nano /etc/pam.d/sshd

Add this line to the end of the file:

auth required pam_google_authenticator.so 

Next, we will configure SSH to support this type of authentication. Open the SSH configuration file for editing.

┌──(kali㉿kali)-[~]
└─$ sudo nano /etc/ssh/sshd_config

Look for this setting; if it does not exist, add it:

ChallengeResponseAuthentication yes

After that, restart the SSH service and MFA will already be working.

┌──(kali㉿kali)-[~]
└─$ sudo systemctl restart ssh

Notice that after the Password line, there is a Verification code, which is the code generated by Authenticator on your phone.