• January 6, 2025
• in Linux
• 1 min read

Sudo Two-Factor Authentication

This can be done using PAM (Pluggable Authentication Modules).

Install libpam-google-authenticator.

sudo apt update
sudo apt install libpam-google-authenticator

Set up Google Authenticator

google-authenticator

• yes to time based tokens.
• Scan the QR code with your prefered authenticator app.
• Save the emergency backup codes in a secure place.

Edit the PAM configuration for sudo.

sudo nano /etc/pam.d/sudo

Add the following line at the top (before any other auth lines)

auth required pam_google_authenticator.so

Test the setup

sudo ls