authy/authy-ssh — pull request #31 by DigitalDJ (2014-06-13 16:51:05+00:00)
Title: Add a grace time to allow new sessions to not require two-factor authent...

...ication, if a session was recently opened.

This patch enables a grace time feature in authy-ssh. One can set a grace time (in seconds) per user, that will prevent prompting for two-factor authentication if a successful login using two-factor authentication was completed recently. It also ensures to not grant the grace period unless the user is connecting from the same IP address.

This would also allow SFTP use with authy-ssh. A user may first login to a normal ssh prompt using two-factor authentication. Once completed, if a grace period is set, SFTP will begin to work.

One could further extend this patch to use $SSH_ORIGINAL_COMMAND, to limit the processes grace time should apply to. For example, grace time should apply to SFTP but not an rsync command.

I've tried to keep things as clean as possible without knowing the ins and outs of Bash. So feel free to clean it up, if necessary.