---
title: Using MFA for SSH Proxy
slug: kronpam-reference-guide-3-9-0/using-mfa-for-ssh-proxy
description: Learn how to enable multi-factor authentication (MFA) for SSH Proxy in this comprehensive document. Follow step-by-step instructions for activating MFA through Kron PAM credentials and MFA token. Essential prerequisites such as obtaining the QR code, inst
docTags: 
createdAt: 2022-07-31T17:27:56.000Z
---

MFA can be used as an enhanced security level for SSH Proxy.


When the user opens an SSH Client (Putty, SecureCRT, etc.), the user is asked for their Kron PAM credentials to connect to the SSH Proxy. After the successful credential login, if MFA is activated for SSH Proxy, the user is asked for an MFA token.


To enable MFA for SSH Proxy:

:::hint{type="success"}
Admin and the users have the QR code, installed the Kron PAM mobile app, scanned the QR code with the mobile app, and MFA is enabled for the user group which will use MFA for SSH Proxy. 
:::

1. Establish an SSH connection to Kron PAM insallation server as the **pamuser** user.
2. Edit the **nsso.properties** file with the command below:
   `vi /pam/ssh/conf/nsso.properties`
   Check the configuration file to see if the parameter below is already configured. If not, add the lines below. If there is a hash ( # ) sign in front of the parameters, delete the hash ( # ) sign to activate the parameter. If the parameter value is false, change it to true. To type or add anything in the vi editor, first press the Insert button on the keyboard, then type in the necessary line. Press Esc to exit typing mode. To save the file press Esc, then colon ( : ), then type in **wq!**, and press enter. If you don’t want to save the changes on the file, press Esc, then colon ( : ), then type in **q!**, and press Enter.   
   - **nsso.connection.initial.otp.enabled=true
      **(required)****
     **nsso.connection.initial.otp.cache.enabled=true
      **(optional, prevents repeated OTP queries within the cache period)****
     **nsso.connection.initial.otp.cache.sec=xxx (second) **(works in conjunction with the line above, not necessary if the cache.enabled line is set to false or if it is commented out)
3. Restart the SSH Proxy with the command below
   `sudo systemctl restart pam-ssh`

After these steps, OTP will be required after the SSH Proxy log in.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/eGNhBO163ccX0USrsP9k__image.png "Enabling MFA to SSH Proxy")

**Displaying the Remaining OTP Cache Time on SSH Proxy**

When you connect to Kron PAM through the SSH Proxy, you enter a one-time password (OTP) value. SSH Proxy stores this OTP value in a cache for a limited time. While the cached value is valid, you don't need to enter a new OTP value for each device connection.

SSH Proxy displays the remaining validity time of the cached OTP value on the terminal screen. The message appears after you log in and after you select a device:

| Using token in cache. Token is valid for ...... seconds. |
| -------------------------------------------------------- |

The number of seconds in the message shows how long the cached OTP value remains valid. When this time expires, SSH Proxy asks you to enter a new OTP value.  

This message appears in the Kron PAM web terminal and in third-party SSH clients, for example PuTTY and MobaXterm*.*

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/2sqi8NIaDZmboGhNrrWhu_image.png "Figure – Displaying the Remaining OTP Cache Time on SSH Proxy")