+1 for Duo. I actually wrote a Chef recipe for enabling 2-factor auth on Linux.

https://github.com/hungtruong/chef-duo-unix

It's my first recipe so feedback would be appreciated if you actually use it!