Using Google Authenticator for MFA with RADIUS
As discussed, a 2FA authentication scheme is the best option for accessing public-facing services, especially any services facing the public internet, whereas in days gone by, you might have configured a simple user ID and password for authentication. With the ongoing Short Message Service (SMS) compromises, we see it illustrated in the press why SMS messages are a poor choice for 2FA—it's lucky that tools such as Google Authenticator can be configured for this use case at no cost.
First, we'll install a new package that allows authentication to Google Authenticator, as follows:
$ sudo apt-get install libpam-google-authenticator -y
In the users file, we'll change user authentication to use pluggable authentication modules (PAMs), as follows:
# Instruct FreeRADIUS to use PAM to authenticate users DEFAULT Auth-Type := PAM $ sudo vi /etc/freeradius/3.0/sites-enabled/default
Uncomment the pam line, like...