SSH can use a variety of authentication methods, such as passwords and key pairs. Less common, and not particularly user friendly, are methods like OPIE. The latter is available per default in FreeBSD (and a few other BSDs I believe), but I can't recall a single case where I've seen it being used in the wild. Other implementations, like Google Authenticator make MFA easy to integrate and use, without being too disruptive for the user.