Sign in to a Linux computer or server with phone approval

Linux sign-in with a second factor is in development. When your organization turns it on, signing in to a Linux computer, opening an SSH session or running sudo will ask, after your password, for an approval on your phone or a code from your authenticator app.

How do I sign in?

1. Type your Linux password as usual.
2. The terminal or the sign-in screen shows a line such as "Approve on your phone and type 482 917".
3. On your phone, open the request, check the computer's name and the action, type the code shown and approve. Confirm with your fingerprint or PIN.
4. Back at the computer, press Enter. The terminal shows "Approved" and the session opens.

Instead of approving on the phone, you can type the six-digit code of your authenticator app at the prompt "Press Enter once approved, or type the app code".

What if there is no network?

• At the computer itself, if you have already signed in online on it, type its offline code when the terminal asks for it. See Sign in to Windows offline: the codes work the same way.
• If you have no code, type R: the terminal shows a challenge to read to your IT support, who gives you a response code.
• Remote sign-in (SSH) is not possible without a network.

Which messages can I see?

See Linux sign-in problems for the others.

What should I never do?

• Never approve a request you did not start: decline it with «It wasn't me».
• Never give anyone your offline codes or the codes of your app. Support only ever reads you a response code for a challenge you read to them.