[39006] in Kerberos
2FA with krb5
daemon@ATHENA.MIT.EDU (Dan Mahoney (Gushi))
Wed Oct 6 17:04:44 2021
Date: Wed, 6 Oct 2021 14:01:04 -0700 (PDT)
From: "Dan Mahoney (Gushi)" <danm@prime.gushi.org>
To: kerberos@mit.edu
Message-ID: <5ee92454-ec38-d5de-5b36-4b2d87fd7f@prime.gushi.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
All,
We use Kerberos but NOT LDAP at the day job.
We'd like to be able to leverage 2fa for some services (admins) and some
services (ssh logins) but not have to pump a 2fa code into, say, our mail
applications. Is there a way to make the acquisition of a TGT (for GSSAPI
authentication) vs Password Authentication require 2fa?
That's complication number one.
Complication number 2 is something like "SecurID is *expensive* for a
fairly small (<10) admin team."
Is there any reasonable support for off-the-shelf TOTP or HOTP
authenticators, i.e. google authenticator or whatnot? If so, is there
support to have a user have *multiple* available authenticators, such that
one can be expired and others not?
Googling this all gets me a bunch of (some older, some newer articles
about the varying states of SPAKE and the like), and...a whole bunch of
ads now being shown for startups that want to do it differently but I'm
SURE no way to integrate with this.
The final problem, of course, is that if I make all my KDC's 2fa-aware on
their own, there's no communication of double-use of a token, unless I
centralize things, which breaks the purpose of having geo-diverse KDC's.
I don't suppose the kerberos db replication mechanism has anything that
can also share this state?
This is all pie-in-the-sky stuff, but practical answers "just an FAQ" are
hard to find.
-Dan
--
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
FB: fb.com/DanielMahoneyIV
LI: linkedin.com/in/gushi
Site: http://www.gushi.org
---------------------------
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
