What advantages do you see with OTP for web applications? Could there be the same advantages for SSH?
So the question is, which threats do you have when using SSH keys?
I think one central threat is, that you can not control or know if a user looses his private SSH key. You can not even know or assure in the first, if the user protects his private SSH key with a passphrase. (unless you are using smartcards for the private SSH key).
So in my opinion, yes, it can improve security to also add OTP to an SSH connection given:
- The administrator controlls the creation of the OTP devices and
- You are using hardware OTP tokens
In this case
- the user can keep up security by protecting his private SSH key (which can not be controlled by the administrator, the company or organization)
- the administrator can keep up security by controlling the secure 2nd factor of the OTP token.
I wrote a blog entry about this utilizing privacyIDEA to manage the OTP 2nd factors.