2 factor authentication for Dovecot/Postfix / SSH / PAMHow to install postfix/virtual domains/without mysql authenticationSSH: Two Factor AuthenticationWhat is wrong in my Postfix Dovecot sasl configuration?SMTP authentication failure + PAM-MySQL cannot authenticatePostfix: how to use simple file for SASL authentication?OpenSSH and PAM authentication using a public keyPostfix SASL with Dovecot and Authenticated SmarthostPostfix deny relay for some virtual usersConfiguring postfix and dovecot for Secure IMAP and SMTPDovecot don't use pam session to create home on mail delivery
Who gets an Apparition licence?
Quacks of Quedlingburg Crow Skull Set 2 Keep Drawing
Generate and graph the Recamán Sequence
Can a US President have someone sent to prison?
Mean Value Theorem: Continuous or Defined?
Do space suits measure "methane" levels or other biological gases?
Academic recognition
Fluently Validation of Objects
Does the UK have a written constitution?
Which centaur is more 'official'?
Why do user defined scalar functions require the schema?
Did Wakanda officially get the stuff out of Bucky's head?
How should I behave to assure my friends that I am not after their money?
Can the passive "être + verbe" sometimes mean the past?
Are cosigner founder websites like hireacosigner.com, cosignerfinder.com etc. legit?
Avoid using C Strings on C++ code to trim leading whitespace
Getting geometries of hurricane's 'cone of uncertainty' using shapely?
I hit a pipe with a mower and now it won't turn
Reverse of diffraction
I'm reinstalling my Linux desktop, how do I keep SSH logins working?
Should the Torah be covered or uncovered during the Aliyah blessings?
Who is Johanna in this Joan Baez song - The Winds of the Old Days
How to use JOIN and SUM function to Calculate the total of query returned column?
How to determine what is the correct level of detail when modelling?
2 factor authentication for Dovecot/Postfix / SSH / PAM
How to install postfix/virtual domains/without mysql authenticationSSH: Two Factor AuthenticationWhat is wrong in my Postfix Dovecot sasl configuration?SMTP authentication failure + PAM-MySQL cannot authenticatePostfix: how to use simple file for SASL authentication?OpenSSH and PAM authentication using a public keyPostfix SASL with Dovecot and Authenticated SmarthostPostfix deny relay for some virtual usersConfiguring postfix and dovecot for Secure IMAP and SMTPDovecot don't use pam session to create home on mail delivery
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?
ssh debian postfix dovecot
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
add a comment |
I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?
ssh debian postfix dovecot
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
1
Repeatedly editing your post to be junk is not appropriate, please stop doing that.
– Ward♦
Jun 10 at 14:13
add a comment |
I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?
ssh debian postfix dovecot
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?
ssh debian postfix dovecot
ssh debian postfix dovecot
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
edited Jun 10 at 14:10
Ward♦
11.8k7 gold badges40 silver badges57 bronze badges
11.8k7 gold badges40 silver badges57 bronze badges
asked Sep 15 '12 at 20:45
user61551
1
Repeatedly editing your post to be junk is not appropriate, please stop doing that.
– Ward♦
Jun 10 at 14:13
add a comment |
1
Repeatedly editing your post to be junk is not appropriate, please stop doing that.
– Ward♦
Jun 10 at 14:13
1
1
Repeatedly editing your post to be junk is not appropriate, please stop doing that.
– Ward♦
Jun 10 at 14:13
Repeatedly editing your post to be junk is not appropriate, please stop doing that.
– Ward♦
Jun 10 at 14:13
add a comment |
2 Answers
2
active
oldest
votes
Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.
Radius is the answer.
All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)
We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu
And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication
The email clients will be prompted for an OTP each time they launch or for each session.
Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
add a comment |
Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f428762%2f2-factor-authentication-for-dovecot-postfix-ssh-pam%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.
Radius is the answer.
All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)
We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu
And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication
The email clients will be prompted for an OTP each time they launch or for each session.
Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
add a comment |
Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.
Radius is the answer.
All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)
We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu
And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication
The email clients will be prompted for an OTP each time they launch or for each session.
Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
add a comment |
Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.
Radius is the answer.
All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)
We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu
And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication
The email clients will be prompted for an OTP each time they launch or for each session.
Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.
Radius is the answer.
All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)
We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu
And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication
The email clients will be prompted for an OTP each time they launch or for each session.
Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
answered Sep 24 '12 at 12:42
nowennowen
1991 silver badge3 bronze badges
1991 silver badge3 bronze badges
add a comment |
add a comment |
Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
add a comment |
Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
add a comment |
Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
answered Sep 24 '12 at 4:49
StarfishStarfish
2,31318 silver badges28 bronze badges
2,31318 silver badges28 bronze badges
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f428762%2f2-factor-authentication-for-dovecot-postfix-ssh-pam%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Repeatedly editing your post to be junk is not appropriate, please stop doing that.
– Ward♦
Jun 10 at 14:13