scp wrapper script for using DUO Passcodes (e.g. from a Yubikey
login_duo supports reading the passcodes from an environment variable. OIT has allowed sending the needed environment in sshd, and the script takes care of prompting the user for the passcode and setting the environment.
Thanks to drews for the pointer!