path: root/ssh-bastion/etc/pam.d/sshd

account     include             base-account

auth        required            pam_google_authenticator.so secret=/srv/ssh/users/${USER}/totp user=root no_strict_owner

session     required            pam_unix.so