#!/bin/bash

# Ensure program is run via sudo
if [ "$(whoami)" != "root" ]; then
    echo "This script must be run as the root user"
    exit 1
fi

echo ""
echo "#============================="
echo "# MULTI-FACTOR AUTH SETUP"
echo "#============================="
echo ""

# The next command needs to be run as the user we are setting up, so switch back
su logname

# Run through Google Authenticator setup
google-authenticator

# Add Google Authenticator to SSH config
cat >> /etc/pam.d/sshd <<EOF
# Google MFA
auth required pam_google_authenticator.so
EOF

sed -i "s/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g" /etc/ssh/sshd_config

# Restart SSH service
/etc/init.d/ssh restart

echo "Multi-factor authentication setup complete!"

#!/bin/bash

# Ensure program is run via sudo
if [ "$(whoami)" != "root" ]; then
    echo "This script must be run as the root user"
    exit 1
fi

echo ""
echo "#============================="
echo "# MULTI-FACTOR AUTH SETUP"
echo "#============================="
echo ""

# Run through Google Authenticator setup
google-authenticator

# Add Google Authenticator to SSH config
cat >> /etc/pam.d/sshd <<EOF
# Google MFA
auth required pam_google_authenticator.so
EOF

sed -i "s/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g" /etc/ssh/sshd_config

# Restart SSH service
/etc/init.d/ssh restart

echo "Multi-factor authentication setup complete!"

--- 
+++ 
@@ -11,6 +11,9 @@
 echo "# MULTI-FACTOR AUTH SETUP"
 echo "#============================="
 echo ""
+
+# The next command needs to be run as the user we are setting up, so switch back
+su logname
 
 # Run through Google Authenticator setup
 google-authenticator
Switch back to normal user for MFA setup

Otherwise, 2-factor auth is going to be set up for the root user. 👎
