google_authenticator would be a possible choice. Make sure to set appropriate permissions. You also have to tell your users to manually move their .google_authenticator file to this location. In ...
which are easy to set up. The app is ad-supported, and there isn't a way to remove the ads. However, ads are unobtrusive and do not interfere with your use. Google's free file manager is easy to use.