What do you regard as “expensive”? Strong 2FA with world-wide acceptable PKI can be obtained for €70 a piece. If you can afford the time, and willing to do your own CA, you can lower it to €15 a piece.
The first can be obtained when applying for Estonian E-resident, https://learn.e-resident.gov.ee/hc/en-us/articles/360000625098-Why-become-an-e-resident second one by buying smart cards at aventra.fi https://aventra.fi/webshop/index.php?route=product/product&product_id=87 From: "Dan Mahoney (Gushi)" <d...@prime.gushi.org<mailto:d...@prime.gushi.org>> Date: Wednesday, 6 October 2021 at 23:18:51 To: "kerberos@mit.edu" <kerberos@mit.edu<mailto:kerberos@mit.edu>> Subject: 2FA with krb5 All, We use Kerberos but NOT LDAP at the day job. We'd like to be able to leverage 2fa for some services (admins) and some services (ssh logins) but not have to pump a 2fa code into, say, our mail applications. Is there a way to make the acquisition of a TGT (for GSSAPI authentication) vs Password Authentication require 2fa? That's complication number one. Complication number 2 is something like "SecurID is *expensive* for a fairly small (<10) admin team." Is there any reasonable support for off-the-shelf TOTP or HOTP authenticators, i.e. google authenticator or whatnot? If so, is there support to have a user have *multiple* available authenticators, such that one can be expired and others not? Googling this all gets me a bunch of (some older, some newer articles about the varying states of SPAKE and the like), and...a whole bunch of ads now being shown for startups that want to do it differently but I'm SURE no way to integrate with this. The final problem, of course, is that if I make all my KDC's 2fa-aware on their own, there's no communication of double-use of a token, unless I centralize things, which breaks the purpose of having geo-diverse KDC's. I don't suppose the kerberos db replication mechanism has anything that can also share this state? This is all pie-in-the-sky stuff, but practical answers "just an FAQ" are hard to find. -Dan -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org --------------------------- ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos
