I could see where this could get annoying for those who create many separate SSH sessions. What would be the best way to require two-factor authentication only if a user is connecting from a new IP address?
I was thinking about the same but I guess that's the downsize of having an extra security.
Something to make it less painful is to use the ControlMaster ssh feature which should allow to reconnect to your server during your session (as long you have the first ControlMaster still connected).. tutorial how to use it randomly taken from google here http://goo.gl/26Oxx
ssh-agent + ssh-add or ControlMaster (depending on how you set things up) will share either a key or the whole connection without requiring you to re-authenticate
I use this approach and it works absolutely wonderfully.
The single, small, annoying caveat (there is always one) is that after an unexpected reboot, you will have lingering dead sockets; if you forget to delete them before starting ssh, ssh will complain and will not overwrite the dead socket.
There's probably a way to get it not to do that, but it happens so infrequently to me that I've never bothered.
I've also noticed that if you SSH into some arcane embedded devices, they behave strangely if you try to open a new channel on the same connection. Tread lightly on anything not OpenSSH on the far end.
Isn't an auth code regenerated every 30 seconds? Just enter the new code displayed on your phone? Two passwords is okay by me for an added layer of security.
