I posted a gist documenting secure defaults for sshd_config which includes Multi-Factor-Authentication (MFA). The configuration strategy aims to mitigate various attacks and exploits, disables password auth, and forces users to use MFA.
You can find the gist here: https://gist.github.com/kyle0r/eb6b9e16ad6366ffa9692169906f128a
