---
title: Using MFA for SSH Connections
slug: kronpam-reference-guide-3-8-0/using-mfa-for-ssh-connections
description: Learn how to configure multi-factor authentication (MFA) for SSH connections using Kron PAM with this step-by-step guide. Enable MFA for SSH login by configuring parameters in the config file, restarting nssoapp, and establishing an SSH connection to Kron
docTags: 
createdAt: 2022-07-31T17:28:01.000Z
---

MFA can be used to establish connections to target devices using any method. This section will provide information on how to configure MFA for SSH connections.


Only users in MFA-enabled User Groups can use MFA for SSH connections: [Enabling Multi-Factor Authentication (MFA)](docId\:XQaSB_MfINqkYJTkqc4bK) 

:::hint{type="success"}
Admin and users have the QR code, installed the Kron PAM Mobile Client Application, scanned the QR code with the Kron PAM Mobile Client Application, and MFA is enabled for the user group that will be using MFA for SSH connections. (See sections [Sending the MFA QR Code to Users](docId\:KeozIWpyP0ZorilDSDLBg), [Creating a Connection Between Kron PAM and the Kron PAM Mobile Client Application](docId\:eri2QHFeViVnDwm0nBjl-) , [Enabling Multi-Factor Authentication (MFA)](docId\:XQaSB_MfINqkYJTkqc4bK) )
:::

1. Establish an SSH connection to Kron PAM server.
2. Run the following commands to set the required parameters in the config file:
   `cd /pam/ssh/conf/
   `
   `vi nsso.properties
   `
   Check the configuration file to see if the parameter below is already configured in it. If not, add the lines below. If there is a hash (#) sign in front of the parameters, delete the hash (#) sign to activate the parameter. If the parameter value is **false**, change it to** true**. To type or add anything in the vi editor, first press the Insert button on the keyboard, then type in the necessary line. Press Esc to exit typing mode. To save the file press Esc, then colon (:), type in **wq!** and press Enter. If you do not want to save the changes to the file, press Esc, then colon (:), then type in **q! **and press Enter.
   **nsso.connection.otp.enabled=true
**
**nsso.otp.cache.enabled=true
**
**nsso.otp.cache.seconds=300**
   The first parameter enables MFA for SSH connections through Kron PAM Web GUI. The second parameter sets up OTP caching, and the third one sets the cache value to 300 seconds. This means that if a user logs in with OTP they will not be asked for any new OTP for the next 300 seconds, even if they disconnect and connect again.
3. After the parameters are set, restart SSH by running the command:
   `sudo systemctl restart pam-ssh`
4. After these settings, a user belonging to an MFA-enabled user group will be asked for a token when logging in to an SSH server.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/I9j39iYastGtEhtfm0duC_image.png" size="74" width="726" height="474" position="center" caption="SSH Connection Using MFA Token" showCaption="true"}