Two-Factor Authentication: How to Protect Your Accounts

What Is Two-Factor Authentication (2FA)?

Two-factor authentication means you need two things to access your account instead of one: your password (something you know) plus a code from your device (something you have). Even if someone steals your password, they cannot log in without the second factor.

The numbers are clear: accounts without 2FA are 99.9% more likely to be compromised compared to accounts with two-factor authentication enabled (per Microsoft 2023 report).

Types of Two-Factor Authentication

1. Authenticator Apps (TOTP)

Apps like Google Authenticator or Authy generate a 6-digit code that changes every 30 seconds. This is the best option for most use cases.

Advantages:

• Works offline
• Completely free
• Difficult to intercept

Disadvantages:

• If you lose your phone without backup = problem

2. SMS Messages

A code sent via text message. Better than nothing — but the weakest option available.

Issues:

• SIM Swapping: attackers can transfer your number to another SIM
• Message interception is technically possible
• Depends on cellular network availability

3. Hardware Security Keys

Devices like YubiKey or Titan Security Key. You press a physical button to authenticate. The most secure method available.

Advantages:

• Fully resistant to phishing attacks
• No battery or network required
• Extremely fast

Disadvantages:

• Cost (150-300 SAR per key)
• If lost without a backup key = problem

4. Biometrics (Fingerprint and Face)

Biometric authentication through your device. Convenient but not a complete replacement — used as an additional factor.

Quick Comparison

Type	Security	Ease of Use	Cost
TOTP App	High	Medium	Free
SMS	Low	Easy	Free
Hardware Key	Very High	Easy	150-300 SAR
Biometric	High	Very Easy	Built into device

Setting Up 2FA on SSH (Server)

These steps enable Google Authenticator on a Linux server:

1. Install the Package

sudo apt install libpam-google-authenticator -y

2. Run Setup

google-authenticator

The tool asks several questions — choose "y" for each. You will receive a QR code to scan with your authenticator app.

Critical: Save your emergency codes in a secure location.

3. Edit PAM Configuration

# Add to the end of /etc/pam.d/sshd
auth required pam_google_authenticator.so

4. Edit SSH Configuration

# In /etc/ssh/sshd_config
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

5. Restart SSH

sudo systemctl restart sshd

Now every SSH login attempt requires an SSH key plus a TOTP code.

Setting Up 2FA on cPanel

1. Log in to cPanel
2. Search for "Two-Factor Authentication" in the Security section
3. Enable the option and scan the QR code with your authenticator app
4. Enter the code to confirm

Setting Up 2FA on Other Services

Email

• Gmail: Settings > Security > 2-Step Verification
• Outlook: Account Settings > Security > Additional verification

Cloud Platforms

• سحابة أمريكية: IAM > Users > Security credentials > MFA
• سحابة أمريكية: سحابة أمريكية AD > Users > Authentication methods

Development Tools

• GitHub: Settings > Password and authentication > 2FA
• GitLab: Preferences > Account > Two-factor authentication

Best Practices

• Use a TOTP app instead of SMS whenever possible
• Save emergency codes in a secure, encrypted location (password manager)
• Enable 2FA on every account — no exceptions
• Buy two hardware keys if using Hardware Keys — one as backup
• Never share 2FA codes with anyone — ever
• Review your authorized devices every 3 months

CLOUD and Two-Factor Authentication

The CLOUD (cloud.net.sa) control panel supports two-factor authentication for all accounts. CLOUD servers come ready for Google Authenticator activation on SSH. An extra layer of protection at no additional cost.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.