Two-factor for SSH and sudo on Ubuntu: what it stops, and the 2025 CVEs it doesn’t

2025 was a busy year for Linux sign-in security: a sudo bug that hands out root without a sudoers entry, a PAM and udisks chain that does the same on SUSE, and a run of OpenSSH fixes on top of 2024’s regreSSHion. Two-factor authentication is the right answer to some of these and no answer at all to others. Here is which is which, and how to add push or TOTP two-factor to SSH and sudo on Ubuntu.

The 2024–2025 bugs worth knowing

• CVE-2024-6387, “regreSSHion” (July 2024): unauthenticated remote code execution as root in OpenSSH’s sshd, versions 8.5p1 to 9.7p1. Qualys
• CVE-2024-3094, the xz backdoor (March 2024): malicious code in xz 5.6.0 and 5.6.1 that could subvert sshd authentication through a supply-chain compromise. Help Net Security
• CVE-2025-26465 and CVE-2025-26466 (February 2025): an OpenSSH client impersonation bug when VerifyHostKeyDNS is enabled, and a pre-authentication denial of service. OpenSSH security
• CVE-2025-32463, sudo “chroot” (June 2025): a local user could become root through sudo’s -R option, even without being listed in sudoers, in sudo 1.9.14 to 1.9.17. CISA added it to the Known Exploited Vulnerabilities catalog in September 2025. sudo.ws
• CVE-2025-6018 + CVE-2025-6019 (June 2025): a PAM misconfiguration on SUSE 15 chained with a udisks/libblockdev bug to take an unprivileged user to root. Qualys TRU

What two-factor stops, and what only patching stops

Two-factor authentication is a check that runs during authentication. A bug that runs before authentication (regreSSHion, the xz backdoor) or that never asks for authentication (the sudo chroot bug) goes around it. Saying otherwise would be selling you something.

The pattern: patch for the pre-auth and no-auth bugs, and use two-factor for the far more common case — a credential that has escaped. Keys leak from laptops and CI runners; passwords leak from everywhere.

How to add push 2FA to SSH on Ubuntu

One trap catches most people first: when a user signs in with an SSH key, OpenSSH skips the PAM auth stack entirely, so a PAM-based second factor never runs. The fix is to require both methods explicitly with AuthenticationMethods:

# /etc/ssh/sshd_config.d/u2auth.conf
UsePAM yes
KbdInteractiveAuthentication yes
Match Group u2mfa
    AuthenticationMethods publickey,keyboard-interactive

Then put the U2 Secured module in front of the stock password stack, for members of the group only:

# /etc/pam.d/sshd — in place of "@include common-auth"
auth [success=ok default=1] pam_succeed_if.so quiet user ingroup u2mfa
auth [success=done default=die] /usr/lib/u2auth/pam_u2auth.so
@include common-auth

After the key is accepted, the user’s phone shows three numbers and the sign-in goes through only when they tap the one on their screen. The prompt names the machine and the source IP. The full walkthrough — install from the signed APT repository, configure sshd and test from a second session before you log out — is in the docs.

sudo, su, polkit and the desktop login

The same module covers sudo, sudo -i, su, polkit admin prompts (installing software, for instance) and the GDM login and lock screens. That matters because the interesting moment on a compromised account is usually the step from user to root — a stolen password should not be enough to take it. See desktops, sudo and lock screen.

When the server cannot reach the internet

Logins fail closed by default (failmode=secure), but users with offline factors still get in: each user has a TOTP entry in their authenticator app and one-time backup codes, both checked on the machine with no network call. The fleet sign-in log records offline sign-ins and reports them on the next contact, so you can see the gaps rather than guess at them — sign-in log.

Coming from google-authenticator-libpam? The difference is the fleet model: one app and one policy across every machine, one entry in each user’s app for the whole fleet, push approval instead of typing a code, and a central log of who signed in where. Running only your own laptop? The personal setup is free and needs no account.