I just tweaked up the CI radius auth so that all password based authentication for SSH and sudo goes through radius. What this means is the for people who are required to use OTP (admins) or people who have requested to use OTP (regular users) any time they're prompted for a password for those two services it will always be OTP. For all other users password auth falls through to doing kerberos from radius. The sticky bit was not allowing this fall through on the user bastion machines, but I got that figured out. Here's the relevant pieces from /etc/raddb/users: DEFAULT Ldap-Group == "admins", Auth-Type := System Service-Type := Administrative-User, Cisco-AVPair := "shell:priv-lvl=15", Filter-ID := "Raritan:G{Admin}", Fall-Through = yes DEFAULT Auth-Type := Kerberos, Client-IP-Address != 128.135.125.155, Client-IP-Address != 192.5.86.5, Client-IP-Address != 192.5.86.6, Client-IP-Address != 192.5.86.101, Client-IP-Address != 192.5.86.102, Client-IP-Address != 192.5.86.103 Service-Type = Shell-User, Fall-Through = yes Each on of those Client-IP-Address attributes corresponds to a user bastion host: login.ci.uchicago.edu login1.pads.ci.uchicago.edu login2.pads.ci.uchicago.edu login1.beagle.ci.uchicago.edu login2.beagle.ci.uchicago.edu sandbox.beagle.ci.uchicago.edu If there are more user bastion hosts, let me know and I'll add them. Which brings me to a question: Currently this list is hand edited which seems unideal moving forward. Here's what I propose. We make a machine netgroup, say login-servers. Any machine that needs world conduits for SSH has to be in this netgroup. bcfg will use the list of members of the netgroup to make that machine have the 'login' bcfg Group (which configures SSH, PAM, and iptables for world access) and will auto generate the radius config to exclude those hosts from non-OTP auth. How does this sound?