title: Two factor authentication on google compute engine VM breaks console SSH access
body: <p>I'm trying to tighten up security on our Google Compute Engine VMs so I installed and configured libpam-google-authenticator to use Two Factor Authentication. Concisely I did:</p>
  
  <pre><code>&lt;set up ssh public/private key&gt;
  sudo apt-get install libpam-google-authenticator
  google-authenticator # follow steps &amp; scan the code with Google Authenticator on your phone
  /etc/ssh/sshd_config
      ChallengeResponseAuthentication yes
      AuthenticationMethods publickey,keyboard-interactive
  /etc/pam.d/sshd
      # @include common-auth
      auth required pam_google_authenticator.so
  sudo systemctl restart sshd.service
  </code></pre>
  
  <p>This works fine using a client like PuTTY.</p>
  
  <p>Specifically, the problem I have is when I try the HTML SSH button on the Google Compute Engine console page, here's a picture of the button:</p>
  
  <p><a href="https://i.stack.imgur.com/hS477.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hS477.png" alt="gce console ssh connect"></a></p>
  
  <p>It never logs in, it just keeps retrying reporting:</p>
  
  <blockquote>
    <p>Transferring SSH keys to the VM.
    The VM guest environment is outdated and only supports the deprecated 'sshKeys' metadata item. Please follow the steps here to update.</p>
  </blockquote>
  
  <p>2FA must be stopping GCE from being able to transfer the ssh keys it generates, is there any way to enable it or is it incompatible with pam_google_authenticator?</p>
  
  <p>Thanks!</p>