Integrations · Linux SSH
Linux SSH 2FA with pam_radius and phone approval
For teams that administer Linux servers over SSH and want every shell, sudo and su to require a phone approval on top of the password. Linux PAM has a standard RADIUS module; point it at the Notakey auth-proxy and the whole fleet joins the same setup as your VPN.
How it connects
PAM to RADIUS to the proxy, nothing else on the server
sshd and sudo authenticate through PAM. The pam_radius module sends the username and password to the Notakey auth-proxy over RADIUS; the proxy forwards the password check to your RADIUS server, pushes an approval to the user’s phone and returns Access-Accept only when both succeed. The guide covers Debian/Ubuntu with libpam-radius-auth; on RHEL-family distributions the module is packaged as pam_radius and the PAM files live in the same /etc/pam.d/ layout.
With the module set as sufficient, an Access-Accept logs the user in immediately, and anything else falls through to the normal local password check. Your break-glass admin keeps a purely local password; everyone else can be created without one. Their only way in is then RADIUS through the proxy, which means password and phone approval, and there is nothing local to brute-force.
The same proxy and RADIUS server that already protect the VPN and the router’s admin plane serve the Linux fleet too. Nothing changes on the proxy side.
What to know before you start
- The module’s default timeout is 3 seconds. Set it to at least the proxy’s vpn_message_ttl (30 seconds); 60 gives comfortable slack. An instant failure with no push usually means a wrong timeout or shared secret.
- SSH public-key logins skip PAM’s auth phase entirely, so a key-based login does not trigger a push. For key plus push, set AuthenticationMethods publickey,keyboard-interactive and test that variant separately.
- The password travels as PAP between the server and the proxy. Keep that link on a management network, or run the proxy as a container on the host itself.
- The same username must exist in the downstream RADIUS server, in the Notakey service with an onboarded phone, and as a local or directory account on the Linux box. PAM only authenticates; the user still needs an account to log into.
- Protecting sudo means every sudo asks the phone. Sudo’s credential caching keeps that tolerable.
- sshd needs UsePAM yes and KbdInteractiveAuthentication yes; both are the Debian/Ubuntu defaults.
From zero to the first approval
- 01
Set up the emergency exit first
Before touching PAM, give root or a dedicated break-glass admin a strong local password and verify it at the console. The configuration always falls back to local passwords, so this account is your way in if the proxy, RADIUS or the network is down.
- 02
Install pam_radius and point it at the proxy
Install libpam-radius-auth, add one line to /etc/pam_radius_auth.conf with the proxy’s address, the shared secret that pairs with the proxy’s vpn_secret_in and a timeout of 60 seconds, and lock the file to mode 0600.
- 03
Enable it in PAM and test from a second terminal
Add auth sufficient pam_radius_auth.so above the common-auth include in /etc/pam.d/sshd (and sudo, su or login as desired), add try_first_pass to the pam_unix line in common-auth, then SSH in from a second terminal with a RADIUS username and approve the push. Confirm the break-glass account still works before closing the original session.
Frequently asked questions
- Will I be locked out if the proxy or RADIUS is down?
- Not if you keep a break-glass admin with a local password. pam_radius is set as sufficient, so anything other than Access-Accept falls through to the normal local password check.
- Do SSH key logins trigger a push?
- No. Public-key logins skip PAM’s auth phase entirely. For key plus push, set AuthenticationMethods publickey,keyboard-interactive and test that variant separately.
- Which Linux distributions does the guide cover?
- Debian and Ubuntu with libpam-radius-auth. On RHEL-family distributions the module is packaged as pam_radius and the PAM files live in the same /etc/pam.d/ layout.