'auth required /usr/local/lib/pam_google_authenticator.so' (or something very similar) to /etc/pam.d/sshd
It was working.
After a while I came back and there was no 2nd factor. Could an update have removed the line?
Those files will be overwritten by upgrades. Outside of that, nothing else should touch them. Should be easy to use the system patches package to patch that file.