I noticed aws has multi-factory authentication: http://aws.amazon.com/mfa/faqs/#How_does_AWS_MFA_work

This seems to be only for when you login via the web into the web console etc.

In general, could this type of authentication be also applied to when you SSH into a server? As an added layer of security?

  • 2
    Some may argue against this, but setting a strong passphrase on your SSH private key is two-factored: what you have (the private key) and what you know (the passphrase for the key).
    – gravyface
    May 19, 2011 at 17:47

1 Answer 1


As far as I am aware Amazon doesn't offer any way to use the MFA token for SSH auth, but there are a number of free/inexpensive third-party solutions which you can use to add multifactor authentication to your servers. Google offers a tool to let you use their authenticator software as a PAM module. Alternatively, there is an inexpensive MFA device called the Yubikey which can also be used to add MFA to your ssh login process.

While these options are generally good, you should think about the trade off you are making by adopting them. As with anything in security, you are trading flexibility and ease of use for security. With public key auth, you are secure enough for most purposes, you don't need to worry about losing a physical device, and you can easily use automation tools which work over SSH (e.g. Capistrano or Fabric). With an MFA device, you don't need to worry about somebody hacking a machine to gain access to your private key, but you always need that physical device and using automation tools becomes much more complicated if not impossible.

Be sure that the benefits of adopting a MFA setup for SSH auth justify the costs in your situation and don't just set it up for the sake of adding another layer of "security".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.