This document details how to enable two factor authentication (2FA) for XRDP for remote access on SLES 15 SP3 using Google Authenticator.

At the end of the procedure it should be possible to use a mobile phone app as Authy or Google Authenticator to provide a second factor Time-based one-time password (TOTP) when remotely logging in to a SLES 15 SP3 or SLED 15 SP3 with any RDP client.

Important notice: google-authenticator-libpam and qrencode packages come from SUSE PackageHub. SUSE does not provide any support, assistance or guarantees with regard to the software provided by the packages. While the packages from the SUSE PackageHub are not officially supported by SUSE, SUSE Linux Enterprise Server remains supported and supportable when using these packages.

Pre-requisites

• A mobile phone with the Authy app or Google Authenticator installed.
• A SLES 15 SP3 system with GUI installed.
• XRDP service installed and started.
• Firewall configured to permit access on port 3389/TCP  (RDP).

Configuration

systemctl enable --now chronyd.service

Enable SUSE PackageHub repository:

SUSEConnect -p PackageHub/15.3/x86_64

zypper install google-authenticator-libpam
zypper install qrencode

/etc/pam.d/password-auth-ga
#%PAM-1.0
#
auth    required    pam_env.so
auth    optional    pam_gnome_keyring.so
auth    required    pam_unix.so nullok use_first_pass
auth    sufficient  pam_sss.so use_first_pass


/etc/pam.d/gdm-password-ga
#%PAM-1.0
# GDM PAM standard configuration (with passwords)
auth     required       pam_google_authenticator.so forward_pass
auth     requisite      pam_nologin.so
auth     include        common-auth
auth     substack       password-auth-ga
session  required       pam_loginuid.so
account  include        common-account
password include        common-password
session  include        common-session

#auth       include     common-auth

auth        include     gdm-password-ga

/etc/pam.d/xrdp-sesman
#%PAM-1.0
#auth       include     common-auth
auth        include     gdm-password-ga
account     include     common-account
session     include     common-session
session     optional    pam_keyinit.so force revoke
session     required    pam_loginuid.so
password    include     common-password

google-authenticator -t -D -W -r 3 -R 30

-t, --time-based         Set up time-based (TOTP) verification
-D, --allow-reuse        Allow reuse of previously used TOTP tokens
-W, --minimal-window     Disable window of concurrently valid codes
-r, --rate-limit=N       Limit logins to N per every M seconds
-R, --rate-time=M        Limit logins to N per every M seconds

#auth include gdm-password-ga 

auth include common-auth

/etc/pam.d/xrdp-sesman #%PAM-1.0
auth       include     common-auth
#auth        include     gdm-password-ga
account     include     common-account
session     include     common-session
session     optional    pam_keyinit.so force revoke
session     required    pam_loginuid.so
password    include     common-password

References:

Google Authenticator PAM module - https://github.com/google/google-authenticator-libpam

Authy or Google Authenticator for 2FA with XRDP - https://github.com/neutrinolabs/xrdp/wiki/Using-Authy-or-Google-Authenticator-for-2FA-with-XRDP#appendix---google-authenticator-options