&gt; A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this...<p>Problem 1. Now you have to maintain password<p>Problem 2. Now you have to handle prompt. Some Cfg tools are capable but is quite painful for others, which means you can&#x27;t automate 2nd auth. Actually you can automate like 2nd auth there are paid service out there offer API.<p>IMO, actually, better approach:<p>* each instance only allow coming from known network<p>* user must be authenticated and authorized with LDAP &#x2F; added to authorized_keys file and enable SSH logging<p>* automation should retrieve the private key from some safe location and is constantly rotating key across instances. This is quite easy on AWS with IAM if you run infrastructure on AWS. For non-AWS, you just harden the location twice as hard.