Re: add 2FA to ssh

From	Henning Follmann <hfollmann@itcfollmann.com>
Newsgroups	linux.debian.user
Subject	Re: add 2FA to ssh
Date	2020-08-13 17:20 +0200
Message-ID	<ADnbk-6Kn-19@gated-at.bofh.it> (permalink)
References	<ADjKp-4zV-1@gated-at.bofh.it> <ADjU6-4Dl-3@gated-at.bofh.it> <ADmIh-6lf-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Aug 13, 2020 at 09:39:43AM -0500, Nicholas Geovanis wrote:
> On Thu, Aug 13, 2020, 6:47 AM Henning Follmann <hfollmann@itcfollmann.com>
> wrote:
> 
> > On Thu, Aug 13, 2020 at 01:37:39PM +0200, Pòl Hallen wrote:
> > > Hi folks :)
> >
> > >
> > > what it better with 2FA: at ssh login request first 2FA authentication
> > next
> > > ssh password or viceversa?
> > >
> > > thanks!
> > >
> > > Pol
> >
> > sorry to say, but 2FA is again one of the hype things. Why do you need 2FA
> > for ssh. I mean a really good reason.
> > Maintain a good keychain and you wont need 2FA.
> >
> 
> The usual reason is an out-of-band or hardware-based one-time pad. The
> additional password is for that session only.
> 

That is not a reason. This is "how".
The "session only" I kind of get though.
But still. Currently everyone is pushing 2FA and most of the time
the implementation sucks or there is no good reason for it.
And for ssh a password protected keychain is the reasonable
way to go.

-H

-- 
Henning Follmann           | hfollmann@itcfollmann.com

Thread

add 2FA to ssh Pòl Hallen <deben@fuckaround.org> - 2020-08-13 13:40 +0200
  Re: add 2FA to ssh Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-13 13:50 +0200
    Re: add 2FA to ssh Nicholas Geovanis <nickgeovanis@gmail.com> - 2020-08-13 16:50 +0200
      Re: add 2FA to ssh Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-13 17:20 +0200
    Re: add 2FA to ssh Thomas Pircher <thp+debian@p5r.uk> - 2020-08-13 18:40 +0200
      Re: add 2FA to ssh Henning Follmann <hfollmann@itcfollmann.com> - 2020-08-14 14:40 +0200
        Re: add 2FA to ssh Thomas Pircher <thp+debian@p5r.uk> - 2020-08-14 19:20 +0200
  Re: add 2FA to ssh Toni Mas Soler <antomassol@gmail.com> - 2020-08-13 16:30 +0200
    Re: add 2FA to ssh James Allsopp <jamesaallsopp@googlemail.com> - 2020-08-13 16:50 +0200

csiph-web