---
title: Using MFA for SSH Proxy
slug: reference-guide-3-0-0/using-mfa-for-ssh-proxy
description: Learn how to enable multi-factor authentication (MFA) for SSH Proxy using Single Connect with this step-by-step guide. Install the Single Connect app, scan a QR code, configure settings in the "nsso.properties" file, and restart SSH Proxy. Enhance securit
docTags: 
createdAt: 2022-07-31T17:27:56.000Z
---

Single Connect’s built-in MFA can be used as an enhanced security level for SSH Proxy.


When the user opens an SSH Client (Putty, SecureCRT, etc.), the user is asked for their Single Connect credentials to connect to the SSH Proxy. After the successful credential login, if MFA is activated for SSH Proxy, the user is asked for an MFA token.


To enable MFA for SSH Proxy:

1. Pre-requisite: Admin and the users have the QR code, installed the Single Connect mobile app, scanned the QR code with the mobile app, and OTP is enabled for the user group which will use MFA for SSH Proxy. (See sections [Sending MFA QR Codes to Users](docId\:E3U2GulCF51DgUx-s7NH2),  [](https://app.archbee.com/docs/jsymInd0w_SXayMlKGOmR/HXrij-XTDti9BoCp12vm7)[Creating a Connection Between Single Connect and the Single Connect Mobile Application](docId\:qrhIpik_cgHzw4HRMvXTV), [Enabling One-Time Password (OTP)](docId\:q04VhhDDdGmqe5MojptWf) )
2. Establish an SSH connection to Single Connect as the root user
3. Edit the “nsso.properties” file with the command below:
   vi /u01/nssoapp/conf/nsso.properties
   Check the configuration file to see if the parameter below is already configured. If not, add the lines below. If there is a hash ( # ) sign in front of the parameters, delete the hash ( # ) sign to activate the parameter. If the parameter value is false, change it to true. To type or add anything in the vi editor, first press the Insert button on the keyboard, then type in the necessary line. Press Esc to exit typing mode. To save the file press Esc, then colon ( : ), then type in “wq!”, and press enter. If you don’t want to save the changes on the file, press Esc, then colon ( : ), then type in “q!”, and press Enter.  **nsso.connection.initial.otp.enabled=true
**
**nsso.connection.initial.otp.cache.enabled=true
**
**nsso.connection.initial.otp.cache.sec=xxx (second)**
4. Restart the SSH Proxy with the command below
   systemctl restart nssoapp

After these steps, OTP will be required after the SSH Proxy log in.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/eGNhBO163ccX0USrsP9k__image.png "Enabling MFA to SSH Proxy")