SSH MFA · TOTP · YubiKey · FIDO2 · Duo
Ezeelogin adds multi-factor authentication to every SSH session — SSH MFA, often called SSH 2FA — enforced once at the gateway. No PAM module on every server, no agents. And from 7.48.0, critical network devices can require their own step-up challenge.
The gateway, once
Nothing to install
Five for SSH, incl. FIDO2
Recorded and audited
Once placed on a server, a key works until someone removes it. A copy from a compromised laptop, a leaked backup or an exposed CI/CD secret grants immediate access with no expiry and no rate limit.
Whether it's a password or a key, single-factor authentication means stealing one credential is enough. Attackers don't need to break encryption — they just need the file.
PCI DSS v4.0 8.4.2 requires MFA for all non-console access into the CDE. NIST 800-53 IA-2(1) requires it for privileged accounts, and cyber-insurers now ask about it on every renewal.
Six-digit codes from Google Authenticator, Microsoft Authenticator or any TOTP app. Works offline, and each code is single-use by default. Keep the gateway's clock in sync (NTP).
How to set it up →Touch the key to sign in. Codes are verified through Yubico's cloud API, so you'll need a Yubico Client ID and Secret Key, and outbound access from the gateway to api.yubico.com.
How to set it up →Sign in with a fingerprint, PIN, security key or an Android device. The credential only works on your real Ezeelogin domain, so a fake login page can't reuse it. Needs HTTPS with a valid certificate and a domain name. From Ezeelogin 7.37.0.
How to set it up →Approve with a Duo push or enter a Duo passcode. Connect with your Duo Web SDK integration key, secret key and API hostname. The web panel must run on HTTPS with a domain name.
How to set it up →Point Ezeelogin at your RADIUS server with its host and shared secret, and users enter the one-time code from RADIUS when they sign in to the web panel. It covers web panel logins only: SSH sessions in the Ezeelogin shell fall back to the security code.
How to set it up →A memorised phrase of at least 10 characters. At login, users type the characters from three random positions, never the whole phrase, and the web panel and SSH ask for different positions.
How to set it up →Google Authenticator, YubiKey and Duo can all be enabled for the same user, so a lost phone or a forgotten key doesn't lock anyone out.
Signs in with a key or password plus a second factor.
MFA is checked when the engineer signs in to Ezeelogin. After that, role-based access control decides which servers they can acess.
Mark core switches, routers, firewalls — or any device group — to ask for a second code each time they're opened. MFA for network devices →
Force MFA for all users from Settings → General → Two Factor Authentication, or only for chosen user groups. Users without MFA are asked to set it up at their next login.
How enforcement works →Set a 2FA timeout in seconds. If no code arrives in time, the authentication session closes and the user starts again. Available from Ezeelogin 7.48.0.
2FA timeout →An admin clears the user's two-factor secret from user management, and the user sets MFA up again at next login. Or they sign in with another method they've already enabled.
Reset a user's 2FA →| Single-Factor SSH | PAM Module Per Server | Ezeelogin Gateway MFA | |
|---|---|---|---|
| Stolen key or password | Immediate access | Blocked on servers that have it | Blocked without the second factor |
| Per-server setup | None — no MFA layer | Install and maintain on every host | None — enforced at the gateway |
| Phishing-resistant option | No | Depends on the module | FIDO2 |
| Methods per user | — | Usually one | Several at once |
| Switches, routers, firewalls | Password only | Not possible — no PAM on the device | Step-up MFA for remote server or network device access (7.48.0) |
| Session recording | No | No | Every sessions are recorded |
Ezeelogin supports these controls; it is not itself certified against them.
SSH MFA — often called SSH 2FA or SSH two-factor authentication — requires a second proof of identity, such as an authenticator code, a push approval or a hardware key, on top of a password or SSH key before a session starts. It matters because SSH keys are single-factor: if a private key is copied, an attacker gets immediate, persistent access to every server that trusts it, with no expiry and no rate limiting. MFA closes that gap.
Yes. PCI DSS v4.0 Requirement 8.4.2 requires MFA for all non-console access into the cardholder data environment, and 8.4.1 for non-console administrative access. Ezeelogin enforces MFA at the SSH gateway for every session, which supports these requirements without configuring anything on individual servers.
Google Authenticator or any TOTP app, YubiKey via Yubico OTP, FIDO2/WebAuthn, Duo Security (push or passcode) and Ezeelogin’s access keyword, all enforced at the gateway before any SSH session starts. Authenticator app, YubiKey and Duo can all be enabled for the same user. Ezeelogin also supports RADIUS 2FA for web panel logins; in the Ezeelogin shell ( ezsh )it falls back to the security code if no other 2FA are enabled or use the recently enabled 2FA method.
Yes, for the web panel. Ezeelogin supports SAML and OpenID Connect with Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, Keycloak and more, so your identity provider’s MFA protects that login. SSH sessions use Ezeelogin’s own 2FA, because SAML and OpenID Connect can’t authenticate SSH. For users already signed in to the web panel through SAML or OpenID Connect, you can skip the second prompt. See identity and access management for SSO setup.
Not by default. MFA is verified once, when you sign in to the Ezeelogin gateway, and access to individual servers is then governed by role-based access control.
