Would like to ask, particularly those who run large environments with lots of users, if there are any standardized- or industry-recommended ways to securely distribute the verification codes to remote users and/or force the user to rerun google-authenticator the very first time they log in via ssh to a Linux host that is configured with the libpam module requiring a user to enter the unix password plus the verification code every time they log in over ssh? Assuming the system administrator sets up the account, is there a way to either;
(a) not require google-authenticator the first time they log in, and force them to run it so that they can securely retrieve their verification code -or- (b) the system administrator runs it for them as part of creating the account, and securely (and easily, given there may be a lot of users) distributes the code plus the unix password to the user?
Note that a system admin can use the "chage" command to force a user to change their unix password the first time they log in.
Am interested in all practical solutions to this, particularly those that are implemented successfully in large environments. How do you get the two-factor codes to new users? Send it via txt message to their cell phones? Write it on pieces of paper and hand it to them? ....?