--- title: SSH authentication with 2FA | daily.dev description: Teleport, an SSH access tool, now natively supports Universal Second Factor (U2F) authentication in addition to its existing Google Authenticator support. The... canonical: https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH authentication with 2FA | daily.dev og:description: Teleport, an SSH access tool, now natively supports Universal Second Factor (U2F) authentication in addition to its existing Google Authenticator support. The... og:url: https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv og:image: https://api.daily.dev/og/posts/O0QqOKGbV.png og:image:alt: SSH authentication with 2FA og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH authentication with 2FA **[Teleport](https://daily.dev/sources/teleport)** · 5 min read · 0 upvotes · 0 comments ## Summary Teleport, an SSH access tool, now natively supports Universal Second Factor (U2F) authentication in addition to its existing Google Authenticator support. The post explains what U2F is, how it works using a USB/NFC/Bluetooth hardware key and public key cryptography, and why it's considered more secure than SMS or TOTP/HOTP-based two factor authentication due to built-in MITM and phishing protection. It also covers browser support (Chrome and Opera at the time) and provides configuration instructions for enabling U2F in the Teleport Auth Service. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable U2F two-factor authentication in Teleport? Enable it in the Teleport Auth Service configuration file by setting u2f.enabled to true, specifying an app_id (typically the Teleport proxy URL), and listing the proxy server URLs under facets. Once configured, U2F can be used for authentication from both the terminal and the web interface, requiring a physical U2F device like a YubiKey. _daily.dev surfaces practical configuration guides for developers hardening SSH access with hardware keys._ ### Why is U2F more secure than TOTP-based two-factor authentication like Google Authenticator? U2F uses public key cryptography where the device holds a private key and signs challenges verified against a public key, unlike TOTP/HOTP which relies on a shared secret vulnerable to compromise. U2F also checks the requesting application's origin and TLS channel ID, providing built-in protection against man-in-the-middle and phishing attacks that TOTP codes lack. _developers evaluating 2FA options can weigh these security trade-offs through daily.dev's coverage of authentication methods._ ### Which browsers support U2F hardware key authentication? Only Chrome and Opera supported U2F natively at the time, though Linux command-line users could add support using the u2f-host utility. This limited browser support meant coordination between the browser or CLI tool and the connected USB device was required for the authentication challenge-response flow to work. _teams standardizing on hardware-key auth can track browser and tooling compatibility via daily.dev._ ## Similar posts on daily.dev - [Two-Factor Authentication Breaks Free from the Desktop](https://daily.dev/posts/two-factor-authentication-breaks-free-from-the-desktop-ufoj6gmjt) · Dark Reading · 0 upvotes · 0 comments - [Laptops all have built-in security tokens these days](https://daily.dev/posts/laptops-all-have-built-in-security-tokens-these-days-wycxvivb7) · Lobsters · 1 upvotes · 0 comments - [Introducing passkeys and multiple 2-step verification factors to enhance your account security](https://daily.dev/posts/introducing-passkeys-and-multiple-2-step-verification-factors-to-enhance-your-account-security-2mvukttxn) · Atlassian · 0 upvotes · 0 comments - [How I Added TOTP-Based SSH Authentication to a CloudLinux 9 cPanel Server](https://daily.dev/posts/how-i-added-totp-based-ssh-authentication-to-a-cloudlinux-9-cpanel-server-bwqmieab6) · Medium · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH authentication with 2FA","url":"https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv"},"datePublished":"2026-08-23T12:22:08.364Z","dateModified":"2026-08-23T12:47:23.083Z","description":"Teleport, an SSH access tool, now natively supports Universal Second Factor (U2F) authentication in addition to its existing Google Authenticator support. The...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,ssh","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH authentication with 2FA"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-authentication-with-2fa-o0qqokgbv#faq","mainEntity":[{"@type":"Question","name":"How do I enable U2F two-factor authentication in Teleport?","acceptedAnswer":{"@type":"Answer","text":"Enable it in the Teleport Auth Service configuration file by setting u2f.enabled to true, specifying an app_id (typically the Teleport proxy URL), and listing the proxy server URLs under facets. Once configured, U2F can be used for authentication from both the terminal and the web interface, requiring a physical U2F device like a YubiKey. daily.dev surfaces practical configuration guides for developers hardening SSH access with hardware keys."}},{"@type":"Question","name":"Why is U2F more secure than TOTP-based two-factor authentication like Google Authenticator?","acceptedAnswer":{"@type":"Answer","text":"U2F uses public key cryptography where the device holds a private key and signs challenges verified against a public key, unlike TOTP/HOTP which relies on a shared secret vulnerable to compromise. U2F also checks the requesting application's origin and TLS channel ID, providing built-in protection against man-in-the-middle and phishing attacks that TOTP codes lack. developers evaluating 2FA options can weigh these security trade-offs through daily.dev's coverage of authentication methods."}},{"@type":"Question","name":"Which browsers support U2F hardware key authentication?","acceptedAnswer":{"@type":"Answer","text":"Only Chrome and Opera supported U2F natively at the time, though Linux command-line users could add support using the u2f-host utility. This limited browser support meant coordination between the browser or CLI tool and the connected USB device was required for the authentication challenge-response flow to work. teams standardizing on hardware-key auth can track browser and tooling compatibility via daily.dev."}}]} ```