Here you go: RADIUS-enabled AD authentication of a VPN w&#x2F;Google Authenticator 2nd factor. <a href="https:&#x2F;&#x2F;github.com&#x2F;rharmonson&#x2F;richtech&#x2F;wiki&#x2F;CentOS-7-Minimal-&amp;-Two-factor-Authentication-using-FreeRADIUS-3,-SSSD-1.12,-&amp;-Google-Authenticator" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rharmonson&#x2F;richtech&#x2F;wiki&#x2F;CentOS-7-Minimal...</a><p>You can also set up an SSH CA to validate clients by signed certificates, making managing a farm and its users&#x27; keys much easier. Then you don&#x27;t even need an auth server online.