What a great solution. I will use it, but...
I guess I found a serious security problem.
When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.
I guess I found a serious security problem.
When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.
debug1: Remote: Forced command.