TOTP Authenticator
Browser
Terminal emulator
Wireguard client
I’ve had the weird idea to use libpam-google-authenticator for both SSH and Sudo.
Hell, for one machine I don’t even know the password. I just set it to a long random string. If I need root access, I can get a code from my phone!
That means I open it A LOT.
At one point I also had 4FA for fun. Or 3FA depending on how you look at it.
On server - pubkey + password + TOTP
On client the private key additionally encrypted with a different password.
Anyway…


I’d still only consider that two factors. Something you have (the client/authenticator) + something you know (the passwords).