Securing Linux Mint with Google Authenticator 2FA

Passwords have long been the first line of defense for securing access to computer systems and online services. However, in recent years weaknesses with password-based protection have been repeatedly exposed through major credential breaches across many popular sites and platforms. According to Verizon‘s annual data breach report, over 80% of hacking related breaches leverage either stolen passwords or brute force attacks to break guessing passwords. This troubling trend highlights the risks of relying solely on passwords for securing critical systems and data.

This is why two-factor or multi-factor authentication (2FA / MFA) has emerged as an essential secondary layer of protection. By requiring an additional verification code or token beyond the base password, 2FA ensures that even stolen user credentials cannot grant an attacker access without having possession of a second factor token associated with the legitimate user.

Why Use TOTP Apps for 2FA?

There are a variety of options available for implementing 2FA:

• Hardware tokens – Physical USB keys like Yubikey which must be inserted to prove access and identity during authentication workflows. Also referred to as universal 2nd factor or U2FA.
• SMS text messages – One time passcodes sent via SMS to the user‘s registered phone number. Simple but less secure.
• Email codes – Similar to SMS but delivers tokens via email. Adds authentication but some phishing risks.
• TOTP authenticator apps – Specialized apps like Google Authenticator and Authy which generate time-based one-time passwords locally on user‘s device. No networked connectivity required.

Out of those, TOTP (Time Based One Time Password) authenticator apps provide the most robust, cryptography-based solution for 2FA. By compute one-time codes locally on the user‘s device without needing any direct connectivity, TOTP apps avoid phishing and interception risks associated with delivery channels like SMS or email. This makes software based authenticators the most secure form of 2FA in many contexts.

Google Authenticator is one of the most popular and trusted TOTP apps available, with support for the standard baked into many online services and identity platforms. In this comprehensive guide, we will walk through installing and configuring Google Authenticator to protect Linux Mint logins using Pluggable Authentication Module (PAM) integration.

How Time-Based One-Time Password Authentication Works

To understand how Google Authenticator generates valid login codes for Linux and other systems, we first need to examine the time-based one-time password algorithm (TOTP) which drives the underlying crypto.

TOTP leverages the HMAC-Based One-time Password Algorithm (HOTP), an open standard defined in RFC 4226. The HOTP algorithm makes use of the SHA-1 cryptographic hash function to compute a HMAC tag code from a shared secret key concatenated with a counter value that increments on each request. This provides a method for both the client (Google Authenticator) and server (Linux PAM) to independently compute what should be the same one-time values over time without ever transmitting the actual codes across the wire.

TOTP enhances upon HOTP by incorporating the concept of time rather than an incremental counter. It works by computing the HMAC output based on the Unix epoch time with a 30 second granularity. Instead of a counter getting incremented, the current 30 second time window value as tracked on both the client device clock and server clock is input into the HOTP hashing process to output the 1-time pads:

TOTP = HOTP(Current_Unix_Time_30sec / 30)

As long as the clocks have proper synchronization, both ends will generate matching tokens for 30 second intervals allowing the PAM module to validate login codes against Google Authenticator computed values locally on the user‘s phone.

Now that we understand how TOTP leverages cryptographic concepts like HMAC and hash-based message authentication to enable a shared one-time password workflow, let‘s look at how we can deploy Google Authenticator‘s implementation on Linux Mint.

Installing the Google Authenticator Package on Linux Mint

Google Authenticator functionality on Linux is provided via a PAM module from the libpam-google-authenticator package. Here are the step-by-step instructions for installing this through the APT package manager on Linux Mint 21:

1. Open a terminal window on your Linux Mint desktop

2. Use sudo with apt to install libpam-google-authenticator:

sudo apt install libpam-google-authenticator 

3. Enter your sudo password when prompted to authorize installation

4. Allow the installation process to complete as APT fetches and sets up the authenticator libraries and modules.

5. Verify successful installation with:

google-authenticator -h

This will print help information if Google Authenticator is correctly installed on your system:

With the google-authenticator command now available, we can proceed to set up and configure 2FA for use with Linux Mint logins.

Configuring Google Authenticator

We will now initialize Google Authenticator and generate the TOTP parameters that will be shared between the client app and Linux server for code generation:

google-authenticator

When initialized, you will be presented with a QR code as well as some configuration questions:

The QR code follows a standard URI format defined for TOTP client provisioning:

otpauth://totp/{label}?secret={BASE32SECRET}&issuer={ISSUER}

Here is an explanation of the parameters:

• Label – Simple string identifier for the account. Set by default to the linux username @ hostname
• Secret – Base32 encoded randomly generated secret value used as seed key for TOTP HMAC computations
• Issuer – Optional identity of service associated with the TOTP account

This compact encoding in the QR contains all the information Google Authenticator needs to begin generating valid codes – it essentially functions as importing the shared crytpographic secret that will match what the PAM modules also have access to on the Linux server side for corroboration. Scanning this signs up Google Authenticator into the 2FA workflow.

The configuration questions allow tailoring certain parameters:

• Disallow reuse – Prevent same TOTP value from being accepted more than once to block replay attacks
• Increase window from 30 to 60 seconds – Allows a longer period for users to enter current code

Finally you will be provided a set of emergency scratch codes – these can be used as backup verification codes in case you lose access to your phone with Google Authenticator configured. The scratch codes are presented only once and should be saved in a safe place like a password manager.

With Google Authenticator now enrolled, configured, and ready to start generating time-based one-time pads, we now just need to connect it to Linux PAM for enforcing 2FA at login.

Enabling 2FA for SSH and User Login in Linux Mint

To leverage Google Authenticator‘s TOTP codes during user login, we need to integrate the authenticator PAM module into Linux Mint‘s Pluggable Authentication Module framework that controls validation and permissions granting.

PAM offers a flexible system for stacking modular auth checks and controls using shared object libraries that can be configured through the /etc/pam.d/ directory. We will connect Google Authenticator as an additional verification step along with standard username and password validation.

After installation, the 2FA PAM module is available but needs to be activated and linked by editing the primary common-auth PAM config file:

sudo nano /etc/pam.d/common-auth

Add the following lines to the bottom which will require a TOTP token check before allowing a successful Linux login:

auth required pam_google_authenticator.so nullok
auth required pam_permit.so  

Breaking this down:

• pam_google_authenticator.so – Enables the Google Auth PAM module to check codes
• nullok – Allows login if no token provided, useful if phone with Authenticator is not available
• pam_permit.so – Additional control, stacked modules must allow access

With Google Authenticator now integrated into the authentication workflow via PAM, all user logins including SSH remote connections will first prompt for your TOTP token from the app after the normal password prompt.

If codes ever fall out of sync, you can reset with scratch codes or manually realign the time offset. For lost mobile devices, scratch codes grant emergency backup authentication.

Supporting Multi-Factor Authentication on Other Linux Distributions

While this guide focuses specifically on installing Google Authenticator for 2FA on Linux Mint, the same principles apply to other common Linux distros like Ubuntu, Debian, RHEL, CentOS, Arch, and Gentoo with just minor modifications to the PAM configuration files.

For example, on Ubuntu 22.04 the PAM profile to edit is /etc/pam.d/common-session rather than common-auth.

Just add the following to integrate Google Authenticator MFA:

session required pam_google_authenticator.so 
session required pam_permit.so

And you will achieve the same TOTP protection supporting your Ubuntu infrastructure.

Likewise for RHEL/CentOS the target PAM file is /etc/pam.d/system-auth – add these lines:

auth required pam_google_authenticator.so
auth required pam_permit.so

And Google Authenticator will now provide robust 2FA for Red Hat and CentOS system authentication.

Additional Linux Integration for VPN, Docker, Kubernetes and More

Beyond just SSH and console access, the Linux PAM allows integrating Google Authentictor‘s TOTP verification for many additional services including:

• OpenVPN – Secure VPN tunnel connectivity
• Docker – Container authentication for pulling images
• Kubernetes – API access to orchestrator control plane
• Web Applications – Custom coded login portals

For each case you would modify the specific PAM configuration file rather than the global common-* auth ones. For example with OpenVPN TOTP protection would be added to /etc/pam.d/openvpn on most distributions.

By stacking modules you can require combinations of factors – for example both a U2F hardware key and Google Authenticator code for super high security environments.

Recommended Best Practices for 2FA

When deploying Google Authenticator two-factor authentication for Linux or other environments, follow these best practice guidelines:

• Carefully store and protect emergency scratch codes printed when you first configured Google Authenticator. Consider keeping them in a password manager or safely offline.
• Whenever you get a new smartphone, immediately install Google Authenticator and use the transfer process to migrate TOTP secrets. Don‘t start from scratch.
• For high security production environments, require universal 2nd factors (U2F) hardware keys like Yubikey along with Google Authenticator for defense-in-depth.
• Always verify the current code displayed on Google Authenticator before approving login requests. Confirm even 1 digit diffs.
• When provisioning from QR codes, ensure the source is trusted before granting camera access to capture secrets.
• Enable automatic time sync on devices running Google Authenticator so codes align with server time windows.
• Consider requiring multiple factors for administrative privileged access. For example admin login may mandate hardware U2F and TOTP token.
• Protect printed QR codes and configuration secrets from shoulder surfing, cameras, and unauthorized personnel during onboarding.
• Use the authenticator time correction tokens whenever login codes fall out of sync due to clock differences.

By following these guidelines you can securely benefit from Google Autenticator‘s strong 2FA protection across your Linux infrastructure.

Troubleshooting Common Google Authenticator Issues

In practice you may encounter some common problems with 2FA tokens like login codes falling out of sync or loss of device with Authenticator. Here are some troubleshooting steps for the top issues:

1. Out of sync codes – Server and Authenticator time window no longer match so codes are rejected. Use the self-service "Gentle reset process" by entering 8 additional recovery tokens from Authenticator to realign server.

2. Lost or switched devices – First attempt to transfer via QR code (not re-enroll from scratch). If no longer available use backup scratch codes instead for authentication.

3. Emergency scratch code issues – Contact IT support who can reset the shared TOTP seed key which will invalidate older codes and allow fully resetting with new enrollment on your device.

4. Reused / forged codes – Sometimes if authenticator clock drifts, it may generate identical consecutive codes that work twice even if reuse is disallowed. Use Gentle Reset process to resync timing.

Following these troubleshooting steps allow recovering from most common scenarios that could impact availability of your 2FA-protected accounts and sessions.

The Future of Passwordless Authentication

While two-factor authentication using technologies like Google Authenticator provides significantly enhanced security over reliance on passwords alone, even newer standards are emerging to displace passwords entirely.

FIDO2 and WebAuthn leverage asymmetric cryptography and public key authentication to provide passwordless login experiences for web applications and online services.

Rather than passwords, your device itself becomes the second factor. This approach can offer both improved usability and security against a wide range phishing, social engineering, and credential theft scenarios.

Integration supports has grown steadily with FIDO2/WebAuthn and it represents the future direction for online authentication. For now TOTP authenticator apps provide excellent protection as an intermediate step away from singular password dependence. But in future the password may be removed from the login equation entirely using these passwordless open standards.

Conclusion

Adding Google Authenticator for multi-factor authentication enhances security by requiring an additional verification token beyond just static passwords which can be easily stolen. Integrating the auth modules with Linux PAM to protect SSH and console access hardens Mint and other distribution logins against unauthorized intrusion even in the event of compromised credentials.

TOTP solutions avoid many of the phishing and interception risks of weaker approaches like SMS and email based two-factor. And the expansive native app support across hundreds of web platforms makes Google Authenticator a seamless multi-factor choice protecting against account takeovers.

As threats evolve, technologies like FIDO2 WebAuthn are emerging as potential successors to eliminate passwords entirely. But today Google Authenticator integration delivers crypto-strong assurance for Linux server access and shell logins. Adding 2FA should be a priority for security-conscious system administrators.