The thing I don't like is most 2FA token generators. Ultimately you need to transfer the polynomial that generates the code. Most do that with a QR image. Well so much for security! Others have a one time emergency code. Of course we are talking evil maid attacks, which granted is an unacceptable term these days.
Now Yubikey at least has my attention. But people often leave the key plugged into their notebook. Very true with the Google equivalent which I have heard from Google employees. The keys themselves aren't exactly transferable, but when you have physical access then all bets are off.
If someone fool actually paid me to be sysadmin, I would use a Yubikey.
Note Freeotp let's you input the code but also has the QR code fallback. The phone app however hasn't been updated in years. It does allow you to test out a TOTP scheme. It took me no time to write a script to accept the token on Linux. The tricky part if I recall correctly was setting up the script to accept the token that just expired. You would want to do that to minimize user friction.
Not to get too far off track but I don't allow any web control over my email server. There is no control panel to hack. I ssh into the server and that uses PKI. I do everything via CLI. If ssh is compromised then nothing else will be secure so email would be the last of my problems.
Companies such as Last pass (not an endorsement but an example) supposedly incorporate password generators. If you are going to allow users to set let alone change their own password, you might be able to write a script that generates the password.
If I were to go up to the next level of security I would use mail-crypt. It is just that I see so much chatter about getting it to work.
"Use strong (as in long and/or randomised and impossible to break using
rainbow table attacks) password"
Again, since it's just me, this is do-able. But I'm looking for something practical as well.
I'm getting the feeling that people don't have an MFA implementation.
"if the users are sufficiently discipline"
As a Sysadmin, I can tell you they genuinely are not and they likely never will be.
Hope for the best, plan for the worst.
I also want to clarify that I'm not rejecting any of these suggestions, they're all good.
* Tyler Montney:
> Since this is getting increasingly complicated, I wanted to ask before
> going further. What do you all do? Any recommendations?
Use strong (as in long and/or randomised and impossible to break using
rainbow table attacks) passwords which are used only once (!) and kept
either in the user's brain or in an encrypted password store. Ensure
that authentication data can only be transmitted over encrypted
connections.
These measures cover a lot of ground, if the users are sufficiently
disciplined. Users are usually the weakest link.
-Ralph