Re: authentication methods: how do they work?

2019-03-27 Thread Daniel Jakots
On Wed, 27 Mar 2019 12:31:51 -0400, Boris Epstein wrote: > This is a nice piece of code indeed: > > https://github.com/WIZARDISHUNGRY/totp-util > > But I don't see the login_ code there - which would be > helpful if I were to write a login plugin. Do you know where that > code would be? Not

Re: authentication methods: how do they work?

2019-03-27 Thread Boris Epstein
On Wed, Mar 27, 2019 at 11:05 AM Daniel Jakots wrote: > On Wed, 27 Mar 2019 05:34:49 -0400, Boris Epstein > wrote: > > > It is interesting because some people mention combined methods - like > > SSL hostkey + some second factor being used just in that fashion: > > > >

Re: authentication methods: how do they work?

2019-03-27 Thread Daniel Jakots
On Wed, 27 Mar 2019 05:34:49 -0400, Boris Epstein wrote: > It is interesting because some people mention combined methods - like > SSL hostkey + some second factor being used just in that fashion: > > https://chown.me/blog/2FA-with-ssh-on-OpenBSD.html > > But based on my experience thus far it

Re: authentication methods: how do they work?

2019-03-27 Thread Boris Epstein
On Wed, Mar 27, 2019 at 5:34 AM Boris Epstein wrote: > > > On Wed, Mar 27, 2019 at 2:31 AM Ted Unangst wrote: > >> Boris Epstein wrote: >> > Thanks. It makes sense to be able to select login methods under some >> > circumstances - but do I have an option of forcing the user to log in >> using

Re: authentication methods: how do they work?

2019-03-27 Thread Boris Epstein
On Wed, Mar 27, 2019 at 2:31 AM Ted Unangst wrote: > Boris Epstein wrote: > > Thanks. It makes sense to be able to select login methods under some > > circumstances - but do I have an option of forcing the user to log in > using > > a predetermined set of methods (for instance, password and then

Re: authentication methods: how do they work?

2019-03-27 Thread Ted Unangst
Boris Epstein wrote: > Thanks. It makes sense to be able to select login methods under some > circumstances - but do I have an option of forcing the user to log in using > a predetermined set of methods (for instance, password and then a secure > key, or password and Yubkey, or password and SSL

Re: authentication methods: how do they work?

2019-03-26 Thread Boris Epstein
Thanks. It makes sense to be able to select login methods under some circumstances - but do I have an option of forcing the user to log in using a predetermined set of methods (for instance, password and then a secure key, or password and Yubkey, or password and SSL key)? On Tue, Mar 26, 2019 at

Re: authentication methods: how do they work?

2019-03-26 Thread Todd C . Miller
On Tue, 26 Mar 2019 11:11:35 -0400, Daniel Jakots wrote: > On Tue, 26 Mar 2019 10:01:59 -0400, Boris Epstein > wrote: > > > Hello listmates, > > > > Let's say I have the following configured in my /etc/login.conf > > > > auth-defaults:auth=password,skey,yubikey > > > > Would that mean either

Re: authentication methods: how do they work?

2019-03-26 Thread Daniel Jakots
On Tue, 26 Mar 2019 10:01:59 -0400, Boris Epstein wrote: > Hello listmates, > > Let's say I have the following configured in my /etc/login.conf > > auth-defaults:auth=password,skey,yubikey > > Would that mean either password, or skey, or Yubikey, or should they > all be satisifed? Either.

authentication methods: how do they work?

2019-03-26 Thread Boris Epstein
Hello listmates, Let's say I have the following configured in my /etc/login.conf auth-defaults:auth=password,skey,yubikey Would that mean either password, or skey, or Yubikey, or should they all be satisifed? Also, is there a way to specify that different users have different requirements as