Thank you Alexander.
Do you know of any such product which doesn't need LDAP? I've never worked with LDAP and don't really want to spend time to learn it now.
Would require a bit of work to make it 'universal' but for anything that can use PAM there's google authenticator...
http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators...