What happens if U2 Secured is down or the machine is offline?

The login says U2 Secured is unreachable and asks for a code from the authenticator app or a backup code, checked on the machine. You choose whether a machine with no codes enrolled refuses the login (the default) or lets the password alone through.

Can I lock myself out?

Only members of the group you gate are asked, so keep an administrator account outside it as break-glass, and test from a second session before closing the first. The package also refuses to be removed while PAM lines you added by hand still reference it, because removing it then would refuse those logins.

Does it work with SSH keys?

Yes. sshd can require the key and then the U2 Secured approval, so a stolen key alone is not enough.

How is it priced: per user or per server?

Neither. Each developer account pays one flat monthly plan. A person counts once a month as an active user however many machines they sign in to, and codes are never metered.

Where do users get the app?

The U2 Secured Authenticator is free on the App Store and Google Play. The same app holds the offline codes, and ordinary two-factor codes for other sites too.

Linux · SSH, sudo & desktop

Two-factor sign-in for SSH, sudo and the Ubuntu desktop

Every SSH login, sudo, su, login screen and lock screen on your Ubuntu machines asks for a tap on the U2 Secured Authenticator app, with the number on screen to match. When a machine cannot reach the network, a code from the same app gets you in.

One package on each machine, one app for the fleet, and a log in the developer portal of who signed in where, including the sign-ins a machine decided while it was offline.

Create a free developer account Read the setup guide

What it protects, and how

Number matching, not a bare Approve

The login shows a number and the phone shows three; the user taps the one that matches. A push the user did not start cannot be approved by reflex, and a wrong number denies the sign-in.

SSH, sudo, su, the login screen, the lock screen and admin prompts

For SSH the user approves on the phone and presses Enter, or types a code instead. At the login and lock screens, sudo, su and admin prompts it carries on by itself the moment the phone approves.

Works offline

If the machine cannot reach U2 Secured, it says so and asks for a code from the authenticator app or a single-use backup code, checked on the machine itself. Nothing is sent anywhere for that sign-in.

A sign-in log for the fleet

Each machine registers with a short-lived token and gets its own key. The portal lists every machine and every sign-in, including the offline ones, which the machine reports when it is back online, and shows a gap if a report went missing.

Lockout safety built in

Only members of a group you choose are gated, a named break-glass account always gets in, and the package refuses to uninstall while PAM lines you added by hand still use it.

Your own laptop, free and without an account

One command sets up codes from the authenticator app for sudo and the login screen on a personal machine, checked locally with no U2 Secured account at all.

Set up in four steps

The full guide, with the PAM and sshd lines and what to test from a second terminal, is in the developer docs.

Install the package

From the signed U2 Secured APT repository, on Ubuntu 22.04 or 24.04 or Debian 12, on Intel/AMD or ARM. Check the key fingerprint before trusting it. apt upgrade then brings every release.

curl -fsSL https://u2secured.com/downloads/linux/u2secured.gpg | sudo tee /usr/share/keyrings/u2secured.gpg > /dev/null
gpg --show-keys /usr/share/keyrings/u2secured.gpg   # B725 4213 9302 02C4 8B19  6810 E6C4 2653 4D95 43BA
echo "deb [signed-by=/usr/share/keyrings/u2secured.gpg] https://u2secured.com/downloads/linux stable main" \
  | sudo tee /etc/apt/sources.list.d/u2secured.list
sudo apt update && sudo apt install u2auth
u2auth-admin help

2
Create an app for the fleet
In the developer portal: one app per fleet, named after it, because that name is what users see on every approval. Create a registration token for the machines.
3
Register each machine and enrol each user
u2auth-admin register gives the machine its own key from the token. u2auth-admin enroll links a user to the app once, for the whole fleet, and sets up their offline codes.
4
Turn it on for a group
Gate SSH with two lines in sshd and PAM, and the desktop, sudo and su with the packaged profile. Keep a second session open and test before you log out.

What it costs

The same developer plans as every other U2 Secured integration. The free Developer plan is enough to try it on a few machines.

Plan	Price	Includes
Developer	Free	1,000 active users and 100 push approvals a month, 1 app. Codes are unlimited.
Growth	$99/month	25,000 active users and 100,000 push approvals a month, 5 apps. Codes are unlimited.
Team	$149/month	75,000 active users and 300,000 push approvals a month, 20 apps. Codes are unlimited.
Scale	$199/month	250,000 active users and 1,000,000 push approvals a month, unlimited apps. Codes are unlimited.

One flat monthly price per developer account, not a price per user or per machine. A fleet of servers is one app; each person who signs in counts once a month however many machines they use. Codes from the app (TOTP) and backup codes are never metered on any plan.

Questions administrators ask

What happens if U2 Secured is down or the machine is offline?: The login says U2 Secured is unreachable and asks for a code from the authenticator app or a backup code, checked on the machine. You choose whether a machine with no codes enrolled refuses the login (the default) or lets the password alone through.
Can I lock myself out?: Only members of the group you gate are asked, so keep an administrator account outside it as break-glass, and test from a second session before closing the first. The package also refuses to be removed while PAM lines you added by hand still reference it, because removing it then would refuse those logins.
Does it work with SSH keys?: Yes. sshd can require the key and then the U2 Secured approval, so a stolen key alone is not enough.
How is it priced: per user or per server?: Neither. Each developer account pays one flat monthly plan. A person counts once a month as an active user however many machines they sign in to, and codes are never metered.
Where do users get the app?: The U2 Secured Authenticator is free on the App Store and Google Play. The same app holds the offline codes, and ordinary two-factor codes for other sites too.