Please emerge qrencode and google-authenticator-libpam-hardened.
At the time of writing this, you have to install the MASKED version.
Ensure that your terminal is 90x56 to retain the QR code.
ACCEPT_KEYWORDS="**" emerge -av google-authenticator-libpam-hardened These are the packages that would be merged, in order: Calculating dependencies… done! [ebuild N ] sys-auth/oath-toolkit-2.6.2-r2::gentoo USE="pam -pskc -static-libs -test" 4,196 KiB [ebuild N ] sys-auth/google-authenticator-libpam-hardened-9999::gentoo USE="qrcode" 0 KiB
Execute google-authenticator as the user
$ google-authenticator Do you want authentication tokens to be time-based (y/n) yYour new secret key is: jeronimo! Your potential verification codes are 012345 012345 012345 012345 012345 Your emergency scratch codes are: 88888888 88888888 88888888 88888888 88888888 Do you want me to update your "/home/<user>/.google_authenticator" file? (y/n) y Do you want to disallow multiple uses of the same authentication token? This restricts you to one login about every 30s, but it increases your chances to notice or even prevent man-in-the-middle attacks (y/n) y By default, a new token is generated every 30 seconds by the mobile app. In order to compensate for possible time-skew between the client and the server, we allow an extra token before and after the current time. This allows for a time skew of up to 30 seconds between authentication server and client. If you experience problems with poor time synchronization, you can increase the window from its default size of 3 permitted codes (one previous code, the current code, the next code) to 17 permitted codes (the 8 previous codes, the current code, and the 8 next codes). This will permit for a time skew of up to 4 minutes between client and server. Do you want to do so? (y/n) y If the computer that you are logging into isn't hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attempts every 30s. Do you want to enable rate-limiting? (y/n) y
Open /etc/pam.d/system-login with your editor and add these 2 lines at the bottom:
auth required pam_google_authenticator.so nullok
auth required pam_permit.so
Configure SSHD
Open /etc/sshd/sshd_config in your editor and ensure the following settings are present.
PubkeyAuthentication no PasswordAuthentication yes UsePAM yes ChallengeResponseAuthentication yes
Note: If pubkey is enabled, it will override 2FA completely.
GDM
Editing /etc/pam.d/system-login as above should be enough, just restart the gdm service :)
You'll use your normal password and then be prompted for your 2FA code.
QR Codes
You can generate your own QR codes on the cli and output to screen or image file.
qrencode -t ansi -l H -o - <STRING>
will output to screen.
qrencode -s30 -l H -o qrcode.png <STRING>
will output to png.
