Servor.

Security

SSH 2FA (TOTP)

TOTP on SSH via Google Authenticator PAM. Destructive: touches SSH auth.

A recipe is not a frozen script: it is a verified playbook that drives an AI run. Reconnaissance first, idempotent by design, and every step proves itself before the next one starts.

Category
Security
Risk
destructive
Verified steps
3
Estimated
~3 min
Systems
Ubuntu · Debian · RHEL · Fedora · Rocky · AlmaLinux
01

Reconnaissance — before touching anything

The run starts read-only. Before a single change, Servor checks the real state of your server — a real machine is rarely clean, and only what is actually there decides what happens next.

  • 01PAM module already installed?
  • 022FA already configured on sshd?
02

The steps — each one proves itself

The playbook below guides the run; the model adapts each command to the distribution and state found during reconnaissance. A step only counts as done when its verification passes.

  1. 01

    Install the PAM module

    Verified by

    command -v google-authenticator
  2. 02

    Enable on sshddestructive

    Verified by

    grep -c pam_google_authenticator /etc/pam.d/sshd
  3. 03

    Reload sshd

    Verified by

    systemctl is-active ssh
03

How Servor runs this recipe

Servor is zero-knowledge: the platform cannot execute anything on its own. When you launch this recipe, an AI run reads the reconnaissance, plans the steps, and asks for your approval. Each approved command is signed by your browser — with a key the server never sees — then relayed to the agent, which verifies the signature locally before executing.

  • Read-only reconnaissance before any change
  • Every command signed by your browser, approved by you
  • Each step verified before the run moves on

More security recipes

Run this recipe on your server

Connect a server, launch the recipe, and approve each step as Servor executes and verifies it. Free plan, no card required.

Start for freeBrowse all recipes