Questions[two-factor](server)

I'm trying to enable 2FA with ssh using libpam-google-authenticator. Not all users need authenticator enabled. Everybody uses ssh public keys, and nobody has a password. I'm running Debian buster, and I've also tried libpam-google-authenticator from bullseye.

My problem is that no matter what I put in the PAM config, users without authenticator enabled are never logged straight in, but always asked for a password.

I've install libpam-google-authenticator and configured /etc/ssh/sshd_config with:

PasswordAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
PasswordAuthentication no
PermitEmptyPasswords no

I haven't been able to work out the correct PAM config so that users without a .google_authenticator file are still logged in. Depending on what I use, users are either prompted for a password (they don't have one), or not allowed in at all.

In /etc/pam.d/sshd I've tried (like this Trying to get SSH with public key (no password) + google authenticator working on Ubuntu 14.04.1):

#@include common-auth
auth       required     pam_google_authenticator.so debug nullok

In this case, users without an authenticator setup get rejected with the following debug;

Aug 05 15:11:18 <host> sshd(pam_google_authenticator)[746624]: debug: start of google_authenticator for "<user>"
Aug 05 15:11:18 <host> sshd(pam_google_authenticator)[746624]: debug: end of google_authenticator for "<user>" Result: The return value should be ignored by PAM dispatch
Aug 05 15:11:18 <host> sshd[746620]: error: PAM: Permission denied for <user> from <IP>

Is pam_permit is needed to set up the fallback case?

I've also tried various combinations of auth required and auth sufficient before and after @include common-auth but they all result in users without authenticator being asked for a password and sometimes users WITH authenticator also being asked for a password.

Does anyone have a recipe to make this work?

I'm trying to find how to setup 2FA/MFA on users who login to Jenkins, with Google Authenticator.

Everything I'm finding is about logins to servers/git/etc, but not for the actual USERS in Jenkins.

Does anyone know how to do this?

I have a central server where I stored all the private ssh keys to the different machines that I want to ssh to. Currently, only sysadmins have access to this 'central' server.

Given the above scenario, I like to ask the following questions:

1. How do you protect your private ssh keys? I read about ssh-agent but I am not sure how to use it or if it can be used in this situation.
2. If a sysadmin leaves and he copies all the private ssh keys, then he has access to all the servers. How do you deal with this situation?

Additionally, is two-factor authentication in general less secure, and if so, why?

I need to host stuff for a financial institution on EC2. The bank wants complete Two Factor Authentication so Stuff like having SSH with a key with password. Something like SecureID or similar would be great. How can I effectively create two factor authentication across SSH to my EC2 environment?

Also could I consider OpenVPN as part of the Two Factor encyption?