Hacker News Reader

https://www.stavros.io/posts/u2f-fido2-with-ssh/ goes over using FIDO2 devices with ssh, including storing the secret keys on the hardware. In that sense the passphrase becomes the second factor I guess.

For Mac users, there is this: https://github.com/TimidRobot/mac-ssh-confirm

Doesn't add 2FA so much as it prompts you for each agent use.

On the remote end, you can enable 2FA for logging into the server with libpam-google-authenticator.

There's also this to use a key in the Secure Enclave and Touch ID to confirm authentication: https://github.com/sekey/sekey

Duo also has a PAM module if you'd rather use a push notification https://duo.com/docs/duounix

I've seen PAM modules for otp/totp, but that really only adds security if authenticating against a remote machine, if you validate the second factor locally doesn't that still open you to mitm or other exploits? Can you trust your own environment?