google-authenticator

Do a key exchange with the server to be set up:
ssh-keygen
ssh-copy-id <server to move key to --- remote>
If you already have generated a key just do the copy.

BUT IF YOU DO THAT 2FA DNW!!!

If you need AUTOCONFIG > 2.61

 wget http://ftpmirror.gnu.org/autoconf/autoconf-2.69.tar.gz 
 tar xvf autoconf-2.69.tar
 cd autoconf-2.69
 ./configure
 make
 make install

AA
### RHEL7
yum install autoconf automake libtool pam-devel 

### RHEL6
yum install pam-devel make gcc wget libtool libtool-ltdl-devel

1. BB - Make Google Authenticator
   
   1. NEW: wget https://github.com/google/google-authenticator-libpam/archive/master.zip OR
   2. ORIGINAL: wget https://centosone.binghamton.edu/Upload/GA/master.zip
   3. unzip master.zip
   4. cd google-authenticator-master/libpam
   5. ./bootstrap.sh
   6. ./configure
   7. make
   8. make install
   Check for --- ls -l /usr/local/bin/google-authenticator  
   

   This needs to be done once on a Primary
   *** DO NOT RUN THIS STEP if using a common Authentication Key ***
   
   
   CC # google-authenticator -e 10 -t -Q none -i "Binghamton(Linux)"  -s /var/tmp/$(whoami)_google_authenticator  -d -S 30 -r 1 -R 30 -w 1
   
   https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@ip-172-31-61-139%3Fsecret%3D7NGAYZXEMBH3HB7K
   Your new secret key is: 7NGAYZXEMBH3HB7K
   Your verification code is 107702
   Your emergency scratch codes are:
     14808918
     72164748
     35143098
     98194605
     73297066
   
   check for --- ls -l /usr/local/bin/google-authenticator /usr/local/lib/security/pam_google_authenticator.so
   
   -- sftp the /root/.google_authenticator from the primary machine...
       to /root  
       and 
         useradd -u 1001 -g 4  -c "XAdministrator" -d /home/xadm -m xadm; passwd xadm
         Ddd to wheel: in /etc/group
         cp -p /root/.google_authenticator /home/xadm/.google_authenticator
         chown  xadm /home/xadm/.google_authenticator
         chmod 400 /home/xadm/.google_authenticator
   
   $6$3iiAubxW$iRWWoWa5qkgFxIfH74oe5oJUymlNf5giC3azuoJt5rGf3xujU6oCGsJomUrNaSYgcoHMVbauY3PzEfFEJ8.Lr/
   
   chmod 400 /etc/security/google_authenticator
   
   EE -  # cp -rp /etc/pam.d/sshd /etc/pam.d/sshd.default
   
   
   To the /etc/pam.d/sshd  file
   ADD
   auth required  /usr/local/lib/security/pam_google_authenticator.so nullok
   
   change the following in file: /etc/ssh/sshd_config
   ChallengeResponseAuthentication yes
   
   FF --  # service sshd restart
   
   GA --  Test an ssh connection from a server without a key exchange.
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   -- use this line in /etc/pam.d/sshd for servers with multiple users; this will allow users to have their own keys
   -- auth required  /usr/local/lib/security/pam_google_authenticator.so nullok
   
   -- For user that you want use google authenticator ..
   -- cp /etc/security/google_authenticator /home/<username>/.google_authenticator
         chown  <username> /home/<username>/.google_authenticator
         chmod 400 /home/<username>/.google_authenticator