Open a terminal window, press Ctrl+Alt+T.

sudo apt update

sudo apt install libpam-google-authenticator

google-authenticator

Make tokens “time-base””: yes

ubuntu-google-QR

SCAN QR Code with Authenicator app

Answer questions as follows:

Update the .google_authenticator file: yes
Disallow multiple uses: yes
Increase the original generation time limit: no
Enable rate-limiting: yes

Edit tho file:

sudo nano /etc/pam.d/common-auth

Add the following lines at the end of the file:

auth required pam_google_authenticator.so nullok auth required pam_permit.so

Press CTRL-O and enter to save