Google Authenticator

https://www.linuxsysadmintutorials.com/setup-sudo-with-google-authenticator-for-2-factor-authentication-on-centos-7.html

yum install -y git autoconf automake make libtool pam-devel
git clone https://github.com/google/google-authenticator
cd google-authenticator/libpam
./bootstrap.sh
./configure
./make
./make install
ln -s /usr/local/lib/security/pam_google_authenticator.so /usr/lib64/security/pam_google_authenticator.so
yum install freeradius
sed -i 's/user = freerad/user = root/' /etc/raddb/radiusd.conf
sed -i 's/group = freerad/group - root/' /etc/raddb/radiusd.conf
nano /etc/raddb/users

DEFAULT Group == “GG_S_GOOGLE_AUTH_DISABLED”, Auth-Type := Reject
Reply-Message = “Your account has been disabled.”
DEFAULT Auth-Type := PAM

sed -i 's/^#\ \ \ \ \ \ \ pam/\ \ \ \ \ \ \ \ pam/' /etc/raddb/sites-enabled/default

Comment out all lines in /etc/pam.d/radiusd then add the following

echo auth requisite pam_google_authenticator.so forward_pass >> /etc/pam.d/radiusd
echo auth required pam_lsass.so use_first_pass >> /etc/pam.d/radiusd