Enable TOTP on your Proxmox

Create your TOTP

Login your pve, and click Datacenter > Permissions > Two Factor

Add your first TOTP

Click add then pop the QR code window. Enter the description and using eg.Google Authenicator by your phone. After your scan it by your mobile then enter the verification code.

Now you can logout and re-login that will request your TOTP Authenication.

Setup on SSH

We just setup 2FA in web-UI login. Now we setup TOTP Authenication on SSH also.

1. To install Google Authenticator on pve

• Debian/Ubuntu:

sudo apt-get install libpam-google-authenticator

• RHEL/CentOS:

sudo yum install google-authenticator

1. Configure Google Authenticator and synhronize it with your mobile phone

google-authenticator

After that will be prompted several questions. It suggested to answer “yes” on all questions.

1. Open Google Authenticator When you start this application, choose the  ‘Enter provided key’  option and write your secret key there.

2. Enable two-factor authentication for SSH protocol

• edit /etc/pam.d/sshd file, paste a command below common-auth section.

@include common-auth

auth required pam_google_authenticator.so

1. Open the /etc/ssh/sshd_config

ChallengeResponseAuthentication yes
PasswordAuthentication no

1. Restart SSH service

service sshd restart

Reference

https://kb.nomachine.com/AR12L00828