SSH 2FA / TOTP

NK one-click adds SSH 2FA + fail2ban to the client machine. All paid plans.

Flow

1. SSH Security → Enable 2FA
2. NK configures PAM (/etc/pam.d/sshd) + sshd_config
3. Customer scans QR into Google Authenticator
4. Subsequent login: password + 6-digit code
5. N failures locks user (with fail2ban)

PAM gotchas

• auth required pam_google_authenticator.so before common-auth
• Disable @include common-auth to avoid two password prompts
• Use nullok initially so users without .google_authenticator can still log in
• sshd_config AuthenticationMethods publickey,keyboard-interactive

Fail2ban

5 SSH failures in 5 min → block IP 24h. 50 failures in 1h → permanent block. Whitelist office IPs.