---
title: Two-factor authentication at firewall/chokepoint for servers
description: Add two-factor authentication at firewall/chokepoint for any number of servers cost-effectively, without installing agents/changing configurations.
---

[Academy ](https://www.ssh.com/academy)

# [ Two-factor authentication at firewall/chokepoint for servers](https://www.ssh.com/academy/iam/multi-factor-authentication)

 Written by [Admin](https://www.ssh.com/academy/author/admin) | Sep 24, 2019 4:00:00 AM

The most common authentication method is the password. It is a single-factor authentication that is based on the user knowing a secret. It is also a rather weak form of authentication. Many organizational security policies today require their high-value assets to be secured with [multi-factor authentication (MFA)](https://en.wikipedia.org/wiki/Multi-factor_authentication)

Adding additional factors - "something you have" in addition to the "something you know" - improves security and makes the authentication considerably more resilient to attacks. There are many approaches to implementing the second factor of a two-factor authentication (2FA) - the second factor may be, for example, a security token (such as [RSA SecurID](https://www.rsa.com/products/securid/)) or a mobile phone of the user (such as in [Duo Security 2FA](https://duo.com/solutions/features/two-factor-authentication-methods)).

- [Duo](https://duo.com/)
- [Forty Two](https://www.fortytwo.com/)
- [RSA SecurID](https://www.rsa.com/en-us/products-services/identity-access-management/securid)

 

### Contents

[Deploying Two-Factor-Authentication (2FA) for Server Farms](https://www.ssh.com/academy/iam/multi-factor-authentication?hs_amp=true#deploying-two-factor-authentication-(2fa)-for-server-farms)

## Deploying Two-Factor-Authentication (2FA) for Server Farms

Regardless of the technical implementation, most two-factor authentication solutions require an agent component on the server-side. This means that large deployments that cover many server instances require the installation of an agent component in **each of the protected servers**.

Many of Fortune 500 companies operate internal networks and data centers that include thousands, sometimes tens of thousands, of servers. Covering such massive back-end server volumes imposes a heavy cost - in licenses, manual work and maintenance commitments.

Deploying 2-factor authentication in corporate server volumes may be prohibitively expensive. An approach that offers equal security with considerably reduced cost is required.

 

[View full post](https://www.ssh.com/academy/iam/multi-factor-authentication)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Admin"
  },
  "dateModified" : "2025-03-17T15:23:23.111Z",
  "datePublished" : "2019-09-24T04:00:00Z",
  "headline" : "2FA for datacenters without installing agents",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.ssh.com/academy/iam/multi-factor-authentication",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Academy"
  }
}
```