Otdfbt

Who gets an Apparition licence?

Quacks of Quedlingburg Crow Skull Set 2 Keep Drawing

Generate and graph the Recamán Sequence

Can a US President have someone sent to prison?

Mean Value Theorem: Continuous or Defined?

Do space suits measure "methane" levels or other biological gases?

Academic recognition

Fluently Validation of Objects

Does the UK have a written constitution?

Which centaur is more 'official'?

Why do user defined scalar functions require the schema?

Did Wakanda officially get the stuff out of Bucky's head?

How should I behave to assure my friends that I am not after their money?

Can the passive "être + verbe" sometimes mean the past?

Are cosigner founder websites like hireacosigner.com, cosignerfinder.com etc. legit?

Avoid using C Strings on C++ code to trim leading whitespace

Getting geometries of hurricane's 'cone of uncertainty' using shapely?

I hit a pipe with a mower and now it won't turn

Reverse of diffraction

I'm reinstalling my Linux desktop, how do I keep SSH logins working?

Should the Torah be covered or uncovered during the Aliyah blessings?

Who is Johanna in this Joan Baez song - The Winds of the Old Days

How to use JOIN and SUM function to Calculate the total of query returned column?

How to determine what is the correct level of detail when modelling?

2 factor authentication for Dovecot/Postfix / SSH / PAM

How to install postfix/virtual domains/without mysql authenticationSSH: Two Factor AuthenticationWhat is wrong in my Postfix Dovecot sasl configuration?SMTP authentication failure + PAM-MySQL cannot authenticatePostfix: how to use simple file for SASL authentication?OpenSSH and PAM authentication using a public keyPostfix SASL with Dovecot and Authenticated SmarthostPostfix deny relay for some virtual usersConfiguring postfix and dovecot for Secure IMAP and SMTPDovecot don't use pam session to create home on mail delivery

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

2

1

I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?

ssh debian postfix dovecot

share|improve this question

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

asked Sep 15 '12 at 20:45

user61551

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Repeatedly editing your post to be junk is not appropriate, please stop doing that.
  
  – Ward♦
  Jun 10 at 14:13
  

  
  
  
  

add a comment | 

2

1

I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?

ssh debian postfix dovecot

share|improve this question

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

asked Sep 15 '12 at 20:45

user61551

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Repeatedly editing your post to be junk is not appropriate, please stop doing that.
  
  – Ward♦
  Jun 10 at 14:13
  

  
  
  
  

add a comment | 

I'm wondering if there is some kine of 2 factor authentication module which supports PAM. My dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to the system users. I would like to have it do 2 factor authentication, maybe via yubikey, google authenticator or whatever. And also, how would my mail client handle that?

ssh debian postfix dovecot

share|improve this question

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

asked Sep 15 '12 at 20:45

user61551

share|improve this question

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

asked Sep 15 '12 at 20:45

user61551

share|improve this question

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

asked Sep 15 '12 at 20:45

user61551

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

edited Jun 10 at 14:10

Ward♦

11.8k77 gold badges4040 silver badges5757 bronze badges

2 Answers
2

active

oldest

votes

2

Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.

Radius is the answer.

All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)

We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu

And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication

The email clients will be prompted for an OTP each time they launch or for each session.

Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.

share|improve this answer

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

add a comment | 

3

Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.

share|improve this answer

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f428762%2f2-factor-authentication-for-dovecot-postfix-ssh-pam%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

2

Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.

Radius is the answer.

All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)

We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu

And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication

The email clients will be prompted for an OTP each time they launch or for each session.

Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.

share|improve this answer

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

add a comment | 

2

Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.

Radius is the answer.

All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)

We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu

And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication

The email clients will be prompted for an OTP each time they launch or for each session.

Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.

share|improve this answer

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

add a comment | 

Really, you want to choose the proper authentication protocol that is supported by PAM, the services you want to protect and the broadest number of two-factor authentication servers.

Radius is the answer.

All major two-factor authentication systems support radius. Radius is supported in PAM through the pam-radius plugin. Radius will also allow you to proxy the requests through freeradius (or NPS on AD) which can then perform authorization against your directory. (Meaning that you have one location to disable users.)

We have a number of tutorials that should help: a couple on pam-radius: https://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to & https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-pam-radius-in-ubuntu

And this one on adding two-factor auth to webmail that covers sasl etc.
https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-webmail-for-wikid-strong-authentication

The email clients will be prompted for an OTP each time they launch or for each session.

Pam-tacacs and pam-ldap would be other options, but more difficult and less flexible, IMO.

share|improve this answer

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

share|improve this answer

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

answered Sep 24 '12 at 12:42

nowennowen

19911 silver badge33 bronze badges

3

Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.

share|improve this answer

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges

add a comment | 

3

Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.

share|improve this answer

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges

add a comment | 

Google Authenticator has a PAM module. The instructions for it are here. I'm not sure how it would work with mail.

share|improve this answer

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges

share|improve this answer

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges

answered Sep 24 '12 at 4:49

StarfishStarfish

2,3131818 silver badges2828 bronze badges