OTP (One Time Passcodes) setup allows extra control over access to device. Following setup was tested on Ubuntu Desktop 22.04 LTS only (it did NOT work on Kubuntu 22.04 - KDE Plasma has no required field for OTP code during login and fails to log in).

Installs required package sudo apt install libpam-google-authenticator
Start OTP setup; you'll be able to scan QR code or view init vector google-authenticator
Open PAM settings to configure it to use libpam-google-authenticator sudo nano /etc/pam.d/common-auth
Append following line to end of open file - permissive mode (allow login for user without OTP setup): auth required pam_google_authenticator.so nullok Alternatively, use restrictive mode: auth required pam_google_authenticator.so
Append following line to end of open file then save it auth required pam_permit.so
Open SSH server settings to configure it to be able to use libpam-google-authenticator. If you skip this, you might not be able to log in! sudo nano /etc/ssh/sshd_config
Change existing setting to be this (from no to yes), unless original one is commented out then save changes KbdInteractiveAuthentication yes
Double-check all the changes. Command below restarts sshd to apply configuration changes. If you've made some mistake or something's changed, and you're connected remotely you've just lost access to server/will not be able to open new connection until you fix issue sudo restart sshd.service

Generating OTP using oathtool

Install required packages sudo apt install oathtool gnupg2
Create new file nano totp.sh

Example script content

#!/usr/bin/env bash
while true; do
    oathtool -b --totp "$1"
    sleep 1
done

Make script executable chmod +x totp.sh
Start generating OTPs; store TOTP_INIT_CODE safely ./totp.sh TOTP_INIT_CODE

Last update: 2024-09-25

OTP login setup

Generating OTP using oathtool