We've been using libpam-google-authenticator for a while on all our servers, it's part of our base Chef configuration. Our setup is that key based authenticati

We've been using libpam-google-authenticator for a while on all our servers, it's part of our base Chef configuration. Our setup is that key based authentication works as normal, but if you want to use a password based authentication, you need to 2-factor auth. This approach allows us to maintain security without losing the ability to go "Oh no I'm somewhere without any of my private keys and I really need to log into that server to fix this production error!"