Ben's notes

… on CentOS 6.5

yum install gcc gcc++ pam-devel subversion python-devel git

mkdir /root/google-authenticator; cd /root/google-authenticator
git clone https://code.google.com/p/google-authenticator/

cd google-authenticator/libpam/ 
make && make install

vi /etc/ssh/sshd_config

PubkeyAuthentication no
PasswordAuthentication yes
ChallengeResponseAuthentication yes
UsePAM yes 

# GSSAPI options
GSSAPIAuthentication no
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

vi /etc/pam.d/sshd

#add at top
auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth   required        pam_google_authenticator.so nullok secret=/home/${USER}/.ssh/.google_authenticator

Don't use Google Authenticator for local subnet 192.168.1.0/24

vi /etc/security/access-local.conf
+ : ALL : 192.168.1.0/24
+ : ALL : LOCAL
- : ALL : ALL

Read and answer the yes/no questions. After setup, the user will have a .google_authenticator file in the home directory.

The command will also create a URL and/or a QR code. With Google Authenticator on your mobile phone, capture the QR. It will create a new account automatically.

google-authenticator
  
mv /home/${USER}/.google_authenticator /home/${USER}/.ssh/.google_authenticator

restorecon -Rv /home/${USER}

service sshd restart