I want to set up two factor authentication on a server, on witch I don't have administrative account. The purpose of this is: I want to give some other people possibility to create SSH tunnels to this server (through my account) , but I do not want them to have shell access.
The only clue I've found so far is to create custom .bash_profile script which asks for second password much like in this question:
However it is useless, as it is still possible to login through sftp and remove the script.
So is it even possible to do this without superuser privileges?