>> i've seen mention of a pam approach, but no detail yet.. > > There are instructions on the site I linked to: > > http://code.google.com/p/google-authenticator/wiki/PamModuleInstructions actually i meant/hoped for a pam approach to just key + password enforcement. in lieu of that, what i have seen so far is use ForceCommand and a script to ask some question, it's not pam but perhaps just as good.