Using MFA for SSH Connections

regardless of how mfa is used for kron pam logins, it can also be used to establish connections (ssh/rdp) to target devices using any method in this section will provide information on how to configure mfa for ssh connections only users in enabled user groups can use mfa for ssh connections to enable mfa use for the user group, please refer to the section to set up mfa for ssh connections docid\ fgqar5tv6lsoe8zgmbtfn admin and users have the qr code, installed the kron pam mobile client , scanned the qr code with the mobile client , and mfa is enabled for the user group that will be using mfa for ssh connections (see sections docid 0au1bmrs8rwzogz5kogy4 , docid\ ppbcxkfudfccrxtkbs1jd , docid\ fgqar5tv6lsoe8zgmbtfn ) establish an ssh connection to kron pam from the ssh client as a root run the following commands to set the required parameters in the config file cd /pam/gui/nssoapp/conf/ vi nsso properties check the configuration file to see if the parameter below is already configured in it if not, add the lines below if there is a hash (#) sign in front of the parameters, delete the hash (#) sign to activate the parameter if the parameter value is false , change it to true to type or add anything in the vi editor, first press the insert button on the keyboard, then type in the necessary line press esc to exit typing mode to save the file press esc, then colon ( ), type in wq! and press enter if you do not want to save the changes to the file, press esc, then colon ( ), then type in q! and press enter nsso connection otp enabled=true nsso otp cache enabled=true nsso otp cache seconds=300 the first command enables mfa the second command sets up otp caching, and the third one sets the cache value to 300 seconds this means that if a user logs in with otp they will not be asked for any new otp for the next 300 seconds, even if the user disconnects and connects again after the parameters are set, restart nssoapp by running the command systemctl restart pam ssh after these settings, a user belonging to an enabled user group will be asked for a token when logging in to an ssh server