authy/authy-ssh — pull request #32 by DigitalDJ (2014-06-13 19:13:18+00:00)
Title: Add a customizable grace period to prevent TFA prompts after a recent successful login attempt

This patch enables a grace period feature in authy-ssh. One can set a grace period (in seconds) per user, that will prevent prompting for two-factor authentication if a successful login using two-factor authentication was completed recently. It also ensures to not grant the grace period unless the user is connecting from the same IP address.

This would also allow easier SFTP (GUI clients) use with authy-ssh. A user may first login to a normal ssh prompt using two-factor authentication. Once completed, if a grace period is set, SFTP will not require two-factor authentication.

One could further extend this patch to use $SSH_ORIGINAL_COMMAND, to limit the processes grace period should apply to. For example, grace time should apply to sftp-server but not an rsync command.

I've tried to keep things as clean as possible without knowing the ins and outs of Bash. So feel free to clean it up, if necessary.