# Two factor authentication?

**URL:** <https://forum.ansible.com/t/two-factor-authentication/17068>\
**Category:** Ansible Project\
**Created:** [December 15, 2014, 7:27pm UTC](https://forum.ansible.com/t/two-factor-authentication/17068 "2014-12-15T19:27:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adam\_Morris](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@Adam\_Morris](https://forum.ansible.com/u/Adam_Morris)\
**Post date:** [December 15, 2014, 7:27pm UTC](https://forum.ansible.com/t/two-factor-authentication/17068/1 "2014-12-15T19:27:39Z")

</div>

Greetings,

We are looking at using two factor authentication on our hosts. Is it possible to use Ansible as well or not? To be clear we’re not using it for login but for sudo access.

Adam

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [December 15, 2014, 7:39pm UTC](https://forum.ansible.com/t/two-factor-authentication/17068/2 "2014-12-15T19:39:45Z")

</div>

Hi Adam,

Generally this is done from two-factoring your VPN for login purposes by gating a bastion host.

For sudo, it’s not going to be well supported at this point, but might not be terrible – I think it applying to multiple hosts might be.

Can you share more about the 2FA config you have?

–Michael

---

<div class="post-metadata">

**Author:** ![Adam\_Morris](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@Adam\_Morris](https://forum.ansible.com/u/Adam_Morris)\
**Post date:** [December 15, 2014, 10:50pm UTC](https://forum.ansible.com/t/two-factor-authentication/17068/3 "2014-12-15T22:50:58Z")

</div>

What we currently have is a separate development environment for a joint venture, embedded within our network. This is a small segregated network with two ssh based bastion hosts… We are using 2FA for access to the bastion hosts, plus our admin machine. We also want to add 2FA for some su access… But it doesn’t look like Google Authenticator works with Sudo so we’re probably ok with using Ansible and Sudo…

I have found an option using access files that should work if we lock down the Ansible access to a specific (secured) machine so that that one doesn’t have to use 2FA, but only a veru small number of people will have access to that host anyway.

We are currently using the Google authenticator pam integration, but haven’t set this up on more than a couple of hosts yet. We should be able to roll this out everywhere this way.

Thanks,

Adam