Secure desktop login with a one-time token

Token, Token, Token….

Next, enable Google Authenticator for the desired user account. The Google Authenticator app first must be installed on your smartphone. Open a terminal in Linux and enter the command google-authenticator as your regular user (not root!). The application recommends various configuration options, and you can decide which one works best for you.

The tool describes all configuration values. I answered the first prompt with Yes, after which Google Authenticator spits out some QR code (Figure 1). Next, open the app on your smartphone (Figure 2) and scan in the QR code (Figure 3). In this way, you link the Linux login with the Google Authenticator.

Figure 1: The Google Authenticator generates the required data and prepares the QR code for scanning.

Figure 2: After first opening the Google Authenticator app on your smartphone, Google lets you scan a bar code.

Figure 3: Scanning in the QR code is a cinch and lets you link the Linux login to the Google Authenticator..

The app acknowledges it by giving you a one-time code (Figure 4).However, that doesn't end the setup just yet. The Authenticator then poses further questions to which you can respond at your own discretion. I opted to answer all of them with y . A view of the completed configuration appears in Figure 5.

Figure 4: Google Authenticator confirms the successful linking process by showing a one-time passcode.

Figure 5: A few moments later, the Google Authenticator setup is complete.

Emergency scratch codes appear when responding to questions. You can use these to log in to the computer if the smartphone isn't handy, if the app isn't working, or if the system clocks between computer and smartphone are off. Write down these single-use tokens and store them in a safe place away from your computer.

Trust Is Good

Now that setup is completed, you can put your system through some tests. In principle, it's enough just to log off. However, because you upgraded at the beginning of the setup, you might as well restart the computer.

At the next login session, the system asks for a one-time token along with the usual username and password (Figure 6). Open the smartphone app and enter the indicated token in the login field. Remember, however, that the one-time password is only good for a limited time. Fortunately, generating the TOTP works even when the smartphone is offline.