[draebek]

In addition to what antoncohen wrote, I've seen a lot of people suggest using ForceCommand in sshd_config to run something that will check the Google authenticator code after you've completed key-based authentication. I think ForceCommand has been in sshd for a while, and it might be more suitable for some environments.

I got the ForceCommand idea from a thread last year about setting up two factor SSH auth using Authy: https://news.ycombinator.com/item?id=4444926

[zobzu]

ForceCommand will not let you use SFTP or SCP due to the prompt. You do need the newer version of OpenSSH for proper MFA.