Enforce two-person SSH access with sshd_config: set AuthenticationMethods to publickey,keyboard-interactive:pam. Key first, then a PAM challenge (TOTP, Duo, or a second approver). https://www.valtersit.com/vault/twoperson-rule-ssh-access-with-authenticationmethods-keyboar-50e5ee/
#ssh #mfa #pam
