Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I noticed aws has multi-factory authentication: http://aws.amazon.com/mfa/faqs/#How_does_AWS_MFA_work
This seems to be only for when you login via the web into the web console etc.
In general, could this type of authentication be also applied to when you SSH into a server? As an added layer of security?
As far as I am aware Amazon doesn't offer any way to use the MFA token for SSH auth, but there are a number of free/inexpensive third-party solutions which you can use to add multifactor authentication to your servers. Google offers a tool to let you use their authenticator software as a PAM module. Alternatively, there is an inexpensive MFA device called the Yubikey which can also be used to add MFA to your ssh login process.
While these options are generally good, you should think about the trade off you are making by adopting them. As with anything in security, you are trading flexibility and ease of use for security. With public key auth, you are secure enough for most purposes, you don't need to worry about losing a physical device, and you can easily use automation tools which work over SSH (e.g. Capistrano or Fabric). With an MFA device, you don't need to worry about somebody hacking a machine to gain access to your private key, but you always need that physical device and using automation tools becomes much more complicated if not impossible.
Be sure that the benefits of adopting a MFA setup for SSH auth justify the costs in your situation and don't just set it up for the sake of adding another layer of "security".
