Setup 2FA on centos 8/fedora/rhel based distros

Important note!! If you are facing issues with logging in, check if selinux is running and either disable it or change the contexts. selinux blocks reading your google-authenticator key files.
trial and error

dnf install epel-release -y 
dnf upgrade -y 
dnf install google-authenticator 
google-authenticator 
# YES TO ALL
# BACKUP YOUR CODES
# Then edit below configuration files

OVERVIEW of the files for these configurations
/etc/pam.d/*
login - rules for local (console login)
system-auth - common rules many services
password-auth - common rules for many remote services
sshd - rules for SSHD daemon only

Restrict ssh login with 2fa

/etc/pam.d/sshd (try this first)
#%PAM-1.0
# Test this first SUFFICIENT means that you still can login with password
auth       substack     password-auth
auth       sufficient   pam_google_authenticator.so

/etc/ssh/sshd_config
## add these lines
ChallengeResponseAuthentication yes
KbdInteractiveAuthentication 

#if this works good, change the "sufficient" alternative to "required" in /etc/pam.d/sshd

Restrict login screen with 2fa

Restrict login with 2fa

/etc/pam.d/gdm-password
auth        required      pam_google_authenticator.so # 2fa required before password auth
auth        substack      password-auth # Password login

Restrict console port with 2fa

/etc/pam.d/login 
#%PAM-1.0
auth       substack     system-auth
auth required pam_google_authenticator.so

Sources