Google-authenticator-libpam

brew install google-authenticator-libpam

Add 2-factor authentication for ssh:
 echo "auth required /usr/local/opt/google-authenticator-libpam/lib/security/pam_google_authenticator.so" \
 | sudo tee -a /etc/pam.d/sshd

Add 2-factor authentication for ssh allowing users to log in without OTP:
 echo "auth required /usr/local/opt/google-authenticator-libpam/lib/security/pam_google_authenticator.so" \
 "nullok" | sudo tee -a /etc/pam.d/sshd

See also

• Google Authenticator, sync, libpam-google-authenticator, google-authenticator-libpam (macOS), google-authenticator