First, install the necesssary packages:
% apt-get install libpam-oath oathtool
Generate a key and write it to /etc/users.oath
(NB the key will be in hexadecimal; if you are using Authy you will want to convert it to BASE32):
% KEY=$( head -c 1024 /dev/urandom | openssl sha1 | awk '{ print $2 }' )
% echo "HOTP/T30/6 andrewlkho - ${KEY}" >> /etc/security/users.oath
% chmod 600 /etc/users.oath