Why You Might Not Want to Enable Time Based 2FA on a Remote SSH Server

This might seem against best principles in server management and protection, but if you’ve ever had a server’s time go hay-wire or you lost your phone, you’ll understand the risks you subject yourself and your company to by enabling time based 2FA on a remote server without a recovery plan in place. These situations do occur. One of the first VPS’s I launched did just that. I suspended it for the weekend and when I started it back up some days later the hardware clock had stopped ticking, I couldn’t log into any applications that had time based 2FA enabled. Thankfully I hadn’t enforced 2FA on the SSH server and was able to correct the date and time, no problem, but it was a wake up call. The risk of self-not-so-ransomware is real, although rare and not often considered. We are so used to the “Lost Password” feature on websites that we forget that locking ourselves out of our accounts even our critical accounts is a possibility.

I am not saying you shouldn’t enable time based 2FA auth on remote SSH servers, just stay safe and keep a recovery plan. See other articles I’ve written on this subject below:

Setup 2FA on an SSH Server with Recovery in Mind

How to Enable Google Time Based 2FA on a SSH Server (COMING SOON).