google-authenticator

Do a key exchange with the server to be set up:
ssh-keygen
ssh-copy-id <server to move key to --- remote>
If you already have generated a key just do the copy.

BUT IF YOU DO THAT 2FA DNW!!!

If you need AUTOCONFIG > 2.61

 wget http://ftpmirror.gnu.org/autoconf/autoconf-2.69.tar.gz 
 tar xvf autoconf-2.69.tar
 cd autoconf-2.69
 ./configure
 make
 make install

### RHEL5

# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 5.11 (Tikanga)

# cd /usr/local/src  && mkdir GOOGLE-LPM && cd GOOGLE-LPM  


# yum -y install pam-devel make gcc wget 

# wget ftp://ftp.netbsd.org/pub/pkgsrc/distfiles/libpam-google-authenticator-1.0-source.tar.bz2

# tar xvf libpam-google-authenticator-1.0-source.tar.bz2

# cd libpam-google-authenticator-1.0

# make

# make test

# make install

# mkdir /usr/local/lib/security

# cp -p pam_google_authenticator.so /usr/local/lib/security/.

  cp pam_google_authenticator_testing.so /usr/local/lib/security/.

# google-authenticator -f -D -t -w 17 -r 3 -R 30 -s /etc/security/google_authenticator
  *** DO NOT RUN THIS STEP if using a Common Authentication Key ***
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@ip-172-31-61-139%3Fsecret%3D7NGAYZXEMBH3HB7K
Your new secret key is: 7NGAYZXEMBH3HB7K
Your verification code is 107702
Your emergency scratch codes are:
  14808918
  72164748
  35143098
  98194605
  73297066

# cat /etc/security/google_authenticator
  *** This is the file to sftp to other servers as the  Common Authentication Key ***
7NGAYZXEMBH3HB7K
"RATE_LIMIT 3 30
" WINDOW_SIZE 17
" TOTP_AUTH
14808918
72164748
35143098
98194605
73297066

# cp -rp /etc/pam.d/sshd /etc/pam.d/sshd.default

add one of the following line to file: /etc/pam.d/sshd
-- shared secret for all users
-- ALL Users will reference: /etc/security/google_authenticator
auth  required   pam_google_authenticator.so nullok user=root secret=/etc/security/google_authenticator

-- use this line for servers with multiple users; this will allow users to have their own keys
-- mv /etc/security/google_authenticator /root/.google_authenticator
auth  required   pam_google_authenticator.so nullok

change the following in file: /etc/ssh/sshd_config
ChallengeResponseAuthentication yes

# service sshd restart