Enabling Two-Factor Authentication

3 min read

Passwords leak through phishing and data breaches. With Two-Factor Authentication (2FA), a stolen password isn’t enough to log in, because each login also needs a code from your phone.

Client Area (cp.gozenhost.com) link

1. Log into the client area
2. Click your name (top right) → Security Settings
3. Under Two-Factor Authentication, click Enable
4. Open your authenticator app:
   • Google Authenticator (Android/iOS)
   • Authy (multi-device sync)
   • 1Password or Bitwarden (built-in TOTP)
5. Scan the QR code
6. Enter the 6-digit code to confirm
7. Save your backup code somewhere safe

cPanel link

1. Log into cPanel
2. Go to Security → Two-Factor Authentication
3. Scan the QR code with your authenticator app
4. Enter the 6-digit code
5. Click Configure Two-Factor Authentication

From then on, cPanel asks for a code after your password on every login.

SSH (VPS / Cloud) link

On a VPS you can add 2FA to SSH logins with the Google Authenticator PAM module:

  sudo apt install libpam-google-authenticator -y
  

  sudo dnf install epel-release -y
sudo dnf install google-authenticator -y
  

Run the setup as the user who will log in:

  google-authenticator
  

Answer the prompts:

Scan the QR code with your authenticator app and save the emergency scratch codes.

Configure PAM link

  sudo nano /etc/pam.d/sshd
  

Add this line at the top:

  auth required pam_google_authenticator.so
  

If you log in with an SSH key and want the key plus a code (no password prompt), also comment out the password step in the same file:

• Ubuntu / Debian: #@include common-auth
• Rocky / AlmaLinux: #auth substack password-auth

Configure SSHD link

  sudo nano /etc/ssh/sshd_config
  

Find the existing KbdInteractiveAuthentication line (Ubuntu 22.04 and later ship it set to no) and change it, rather than adding a second line. sshd uses the first value it reads, and files in /etc/ssh/sshd_config.d/ are read before the rest of sshd_config, so check there too. Make sure PAM is on:

  KbdInteractiveAuthentication yes
UsePAM yes
  

Older guides use ChallengeResponseAuthentication, which is a deprecated alias for the same setting.

If you use SSH keys and want 2FA:

  AuthenticationMethods publickey,keyboard-interactive
  

Check the values sshd will actually use:

  sudo sshd -T | grep -Ei 'kbdinteractive|usepam|authenticationmethods'
  

Restart SSH:

  # Ubuntu / Debian
sudo systemctl restart ssh

# Rocky / AlmaLinux
sudo systemctl restart sshd
  

Which Authenticator App? link

What to Do Next link

• First Boot: Initial Server Setup - secure your VPS alongside 2FA
• Connecting to Your Server via SSH - SSH key setup works alongside 2FA
• Free Migration - moving to GoZen from a host without 2FA support? We migrate your accounts intact and you set up 2FA on arrival