Passwords are useful, but impossible to enforce. If anyone decides not to use the passwords for their key you are in the same spot. You need better tools, somet

Passwords are useful, but impossible to enforce. If anyone decides not to use the passwords for their key you are in the same spot. You need better tools, something you can enforce server side. We use two-factor: (note that I founded Authy) http://blog.authy.com/two-factor-ssh-in-thirty-seconds http://blog.authy.com/two-factor-ssh-in-thirty-seconds