Re: [pure-ftpd] TOTP for Pureftpd

Hi,

Am 27.03.2021 um 12:03 schrieb Mario:

> I just though about the use of a Time based One Time Password (TOTP) with pureftpd.

How should that work? Is there an RFC for 2FA in FTP? If not, I believe that
most FTP-clients out there won't be fun to use anymore.

> So the password to be submitted would be something like "FIXED_SECRET-TOTP" 

The best approach here is to create a Draft for the IETF so that the issue
can be discussed by stakeholders. That way, FTP clients can add that feature
to allow easy usage, e.g. by popping up a dialog asking you for the OTP-value
and send it to the server "under the hood" like everything else that happens
on the protocol level.

If you're really concerned about security, use SFTP with public key authentication
with the private key residing on an e.g. Yubikey USB stick (i.e. an external,
hardware based device). If it has to be FTP, consider using FTPS with TLS
client authentication (but here I'm not sure if that is actually supported
by all the FTPS-clients out there) where the private key can again be
kept externally.


Cheers, Lothar