freedomofpress/securedrop — pull request #656 by dolanjs (2014-10-20 17:56:19+00:00)
Title: Password + TOTP as a ssh authentication option

This adds back the libpam-google-authenticator module for 2fa for ssh access.

This does not configure the users 2fa code. The admin users will need to run `google-authenticator` on each server prior to trying to authenticate without the ssh-keyfile

If a admin users 2fa secret file is not created and the user does not have the ssh-private key, they will just see a password prompt and will not be able to authenticate.

There are different errors shown if the pasword failed or if it was the 2fa code.

This does not disable ssh-key files. When you are authenticating via ssh-keyfile the 2fa pam module will not be used.