I couldn't make it work the other way around, but decided I didn't care all that much the prompts make it pretty clear which token is being requested.

The only wrinkle is that when you ssh in without presenting a valid key, it asks for the OATH code before the password. I believe a similar method can be used for TOTP OATH (new OTP every n seconds), but I'm using hardware OATH tokens instead of software ones, and they're yubikeys, which only do HOTP OATH. Skip the digits=8 if you're happy with 6-digit HOTP OATH. Make the authentication file /etc/users.oath, mode 600, owner root:root, and populate it with lines like: #type username pin start seed Ln -s /usr/lib64/security/pam_oath.so /lib64/security/ Install pam_auth (this being the CentOS-oriented way, for x86_64): yum install pam_oath My full writeup can be read at, but the upshot is:Īssuming your sshd is already set up to allow public-key based authentication (most are), add these two lines to sshd_config: PasswordAuthentication no

I'm fairly sure that Google Authenticator is just another OATH implementation. import pyotp, base64 totp pyotp.TOTP( base64.b32encode('bsnz bwpn tji6 flto 5enn 6vd4 wji7 aaaa') ) print 'Current OTP:' + totp. It is definitely possible to configure an sshd to require either a valid keypair or use HOTP (new one-time password (OTP) on each request) OATH-based authentication - I'm doing it. In Google Authenticator, I choosed 'Time Based' already The time on my computer, where script below running is the same as in my phone, where the Google Authenticator app is installed.

Totp or hotp google authentication