安裝地址：http://www.wandoujia.com/apps/com.google.android.apps.authenticator2

註意：機器上一定要關閉selinux

1、安裝依賴：

yum -y install gcc make pam-devel libpng-devel libtool wget git

2、開啟EPEL源

yum –enablerepo=epel

3、或者直接安裝EPEL源RPM包

# CentOS 6

rpm -Uvh http://mirrors.ustc.edu.cn/fedora/epel/epel-release-latest-6.noarch.rpm

# CentOS 7

rpm -Uvh http://mirrors.ustc.edu.cn/fedora/epel/epel-release-latest-7.noarch.rpm

4、安裝Qrencode，谷歌身份驗證器需要調用該程序生成二維碼並顯示

yum install -y qrencode

5、安裝谷歌身份驗證器

git clone https://github.com/google/google-authenticator-libpam.git
cd google-authenticator-libpam/

編譯並安裝

./bootstrap.sh
./configure --prefix=/usr/local/google-authenticator
make && make install

復制google 身份驗證器pam模塊到系統下

cp /usr/local/google-authenticator/lib/security/pam_google_authenticator.so /lib64/security/

6、配置/etc/pam.d/sshd

在

auth       include      password-auth

這一行上面添加下面這行內容

auth       required     pam_google_authenticator.so

註意順序：谷歌認證要在password-auth上面

[root@localhost ~]# cat /etc/pam.d/sshd

#%PAM-1.0
auth       required     pam_sepermit.so
auth       required     pam_google_authenticator.so 
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

7、修改SSH服務配置/etc/ssh/sshd_config

將ChallengeResponseAuthentication no改成yes，即

ChallengeResponseAuthentication yes

8、啟用 Google Authenticator

./google-authenticator

Do you want authentication tokens to be time-based (y/n) y

# 是否開啟基於時間的認證，Y， 測試下來，如果選N，則手機上的驗證碼不會自動更新，使用一次後就算手動更新了驗證碼也無法登錄。

# 接下來會生成二維碼，手機端掃描即可添加安全密鑰

後面一路都是選擇y，就可以了

註意保存好上面的5個emergency scratch codes，如果手機上的驗證碼不通過，可以使用上面的這個驗證碼，每次使用後就失效了。

linux登錄客戶端的設置

參考文檔：

https://shenyu.me/2016/09/05/centos-google-authenticator.html

https://www.sulabs.net/?p=802

CentOS 使用 Google Authenticator 登錄驗證