Ukraine flag

We stand with our friends and colleagues in Ukraine. To support Ukraine in their time of need visit this page

> CentOS 2FA

CentOS 2FA

With Protectimus multi-factor authentication (MFA) solution, you can set up CentOS two-factor authentication (2FA) in a few steps.

1. How CentOS Two-Factor Authentication (2FA) Works

After you enable CentOS 2FA, your users will need to use two authentication passwords to get access to their CentOS accounts:

  1. The first is a standard password (something the user keeps in memory);
  2. The second is a one-time password valid only for 30 or 60 seconds (the one-time password is generated with the help of a hardware OTP token or a 2FA app on a user’s phone – something that the user owns and has to carry with them).

This way, the CentOS account becomes protected with two different authentication factors. Even if the hacker steals the users’s password using phishing, brute force, social engineering, data spoofing, or any other attack, they can’t access the CentOS account without the one-time password from a user’s 2FA token.

This guide shows how you can set up CentOS two-factor authentication (2FA) using Protectimus RADIUS 2FA component for the integration with Protectimus Cloud 2FA service or Protectimus On-Premise MFA Platform.

CentOS 2FA (two-factor authentication) setup scheme

2. How to Enable CentOS Two-Factor Authentication (2FA)

You can set up CentOS two-factor authentication (2FA) with Protectimus using the RADIUS protocol:
  1. Get registered with Protectimus SAAS 2FA Service or On-Premise 2FA Platform and configure basic settings.
  2. Install Protectimus PAM module for CentOS 2FA
  3. Install and configure Protectimus RADIUS Server module.

2.1. Get Registered and Configure Basic Protectimus Settings

  1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
  2. Add Resource.
  3. Add Users.
  4. Add Tokens or activate Users’ Self Service Portal.
  5. Assign Tokens to Users.
  6. Assign Tokens with Users to the Resource.

2.2. Install Protectimus PAM module for CentOS 2FA

yum -y install epel-release
yum -y install pam_radius

2.3. Install and configure Protectimus RADIUS Server

  1. Install protectimus-radius

git clone
cd platform-linux/radius
edit config/radius.yml
docker compose up -d

  1. Configure radius.yml file.

    Configure Protectimus RADIUS Server settings in the radius.yml file. It must be located in the same directory as the executable.

    You will find detailed instructions on available properties that you can add to the radius.yml file here.

    The example of radius.yml file configuration:

  secret: secret
  auth-port: 1812

  #  Could be :
  #  - LDAP

  login: [email protected]
  api-key: aslkjdljsdlaskmWpXjT5K0xqLXkd3
  resource-name: radius
  resource-id: 723

  1. Edit pam_radius config, configure secret


# server[:port] shared_secret      timeout (s)       secret             1

  1. Configure SSH to use challenge response


ChallengeResponseAuthentication yes

  1. Execute the command systemctl restart sshd

  1. Configure PAM for SSH to use RADIUS

    Add auth required after auth substack password-auth into /etc/pam.d/sshd

auth       required
# protectimus pam radius
auth       substack     password-auth
auth       required
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional prepare

CentOS multi-factor authentication setup is now complete. If you have other questions, contact our customer support service.
Last updated on 2023-02-13