I followed these instructions and got google-authenticator setup on an Ubuntu LiveCD for test purposes. And it doesn't work. I've tried running google-authenticator probably ten times and maybe I'm able to login with a auth token during one or two of those ten attempts I'm unable to login a second time even after I was able to log into it the first time.
Here's the text from my setup screen:
Do you want authentication tokens to be time-based (y/n) n https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chi-otpauth://hotp/ubuntu@ubuntu%3Fsecret%3DJQJF34XTTHS7HVNF Your new secret key is: JQJF34XTTHS7HVNF Your verification code is 935720 Your emergency scratch codes are: 57729634 10509722 83516976 49272870 55886103 Do you want me to update your "home/ubuntu/.google_authenticator" file (y/n) y By default, three tokens are valid at any one time. This accounts for generated-but-not-used tokens and failed login attempts. In order to decrease the likelihood of synchronization problems, this window can be increased from its default size of 3 to 17. Do you want to do so (y/n) y If the computer that you are logging into isn't hardened against brute-force login attempts, you can enable rate-limiting for the authentication module. By default, this limits attackers to no more than 3 login attemtps every 30s. Do you want to enable rate-limiting (y/n) n
Anyway I can't figure it out and pretty much, right now, the only thing google-authenticator is good at, in so far as I'm concerned, is locking everyone, admins included, out of a system, permanently.
Is there something I need to be doing that I'm not?