As of 9/5/2018, Duo authentication is required for all logins to Research Computing systems. For some activities, such as scp this can mean multiple Duo exchanges. There are several approaches that set up a single Duo-enabled connection and direct all communication through that channel so that only one Duo authentication is needed.
One approach is to set up a VPN connection. Because VPN requires Duo authentication, Research Computing systems do not require an additional Duo authentication for connections via VPN for the lifetime of the connection (typically a few hours). This is a two step process: (1) set up the VPN and then (2) run your ssh client. The GlobalProtect VPN is recommended. For a few additional tips see "I. VPN Approach" in this guide on GitHub.
A more involved approach that works for Linux and macOS users is to modify the ssh configuration on your workstation to set up a multipexed connection whenever you ssh to a particular host. Then you will go through Duo authentication for your first ssh session but subsequent connections, for example for scp or another ssh session, will not need additional authentication because they share the original connection. The multiplexed connection will only be maintained for a limited period of time. For more information see "II. Multiplexing Approach" in this guide on GitHub.
Learn how to create SSH keys for password-less logins on the HPC clusters.