Help! cant seem to get 2FA to work for my AWS ec2 SSH

Hi I have tried the solution online to include a 2FA system inside. even after I log out it still doesn't require a 2FA and log in as long as a PEM is present and I am not sure what I am doing wrongly

this are the steps that I followed

1 Answer

1. Install PAM

$ sudo apt install libpam-google-authenticator

2. Generate Code

$ google-authenticator

Pick up your favorite app (Google Authenticator, Authy...) and add your (QR)code shown at the screen.

3. Configure SSH

$ sudo nano /etc/pam.d/sshd

Add the following line to the TOP of the file.

auth required pam_google_authenticator.so

Disable user password authentication by commenting out the following line:

#@include common-auth

4. Edit the SSH daemon configuration file:

$ sudo nano /etc/ssh/sshd_config

and configure options like:

ChallengeResponseAuthentication yes
PasswordAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

Followed by:

$ sudo systemctl restart sshd && sudo systemctl restart ssh

5. Try to login in another SSH session while keeping the actual one connected (in case something goes wrong so you can revert changes.)