Setup SSH with MFA

provision.sh

sudo apt-get update
sudo apt-get install -y libpam-google-authenticator

ga_profile=$(cat << EOS
#!/bin/sh

if [ "$USER" != "root" ]; then
  if [ ! -f "$HOME/.google_authenticator" ]; then
    trap 'exit' SIGINT
    echo "Initialize google-authenticator"
    /usr/bin/google-authenticator -t -d -f -w 17 -r 3 -R 30
    trap -- SIGINT
  fi
fi
EOS
)
echo "$ga_profile" | sudo tee /etc/profile.d/google-authenticator.sh

echo "auth required pam_google_authenticator.so nullok" | sudo tee -a /etc/pam.d/sshd
sudo sed -i -e 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config

echo "AuthenticationMethods publickey,password publickey,keyboard-interactive" | sudo tee -a /etc/ssh/sshd_config

sudo sed -i -e 's/@include common-auth/#@include common-auth/' /etc/pam.d/sshd

sudo systemctl restart sshd.service