wire up a hardware security token as a "sufficient" PAM rule. then it's just a tap.