apt install libpam-google-authenticator -y
su - admin && google-authenticator
# /etc/pam.d/sshd: auth required pam_google_authenticator.so
# sshd_config: AuthenticationMethods publickey,keyboard-interactive
systemctl reload sshd
Save emergency scratch codes when setting up 2FA. Without them, losing your phone means losing server access permanently.