It's as easy as installing a PAM module, enabling challenge-response for OpenSSH, and then generating a secret. I set this up yesterday on a an Ubuntu 14.04 vp

It's as easy as installing a PAM module, enabling challenge-response for OpenSSH, and then generating a secret. I set this up yesterday on a an Ubuntu 14.04 vps using this guide: https://www.digitalocean.com/community/articles/how-to-protect-ssh-with-two-factor-authentication https://www.digitalocean.com/community/articles/how-to-prote... It's worth noting that private ssh keys work without 2FA and all password logins are required to use 2FA. That's the security policy I was looking for.