/etc/ssh/sshd_config
ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive:pam
PasswordAuthentication no
/etc/pam.d/sshd
#@include common-auth
auth required /usr/local/lib/security/pam_google_authenticator.so