we use signed certs with authorized principals to manage access [1] and sign the certs after successful MFA. if you need a non-interactive connection you can us

we use signed certs with authorized principals to manage access [1] and sign the certs after successful MFA. if you need a non-interactive connection you can use token authentication to fetch a cert. [1] https://engineering.fb.com/security/scalable-and-secure-access-with-ssh/ https://engineering.fb.com/security/scalable-and-secure-acce...