Re: [pure-ftpd] TOTP for Pureftpd

--=_bbcb758b95b1d55da3d6cb66a618cdec
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8;
 format=flowed

Hello Lothar

Thank you for your feedback.

Compatibility with existing tools would be maintained by still having a 
single password to enter.

Example: suppose the user is Alice and the base password is RabbitFoot, 
then Alice would need to provide a password that is a combination of the 
base password and the TOTP password.  For example, if the TOTP password 
is 75812345, Alice would have the following login/password to enter:  
Alice/RabitFoot75812345 .

SFTP is not so simple to set up and it does not necessarily implement 
2FA.

Also, IMHO "2FA" does not imply that is has to be implemented in two 
steps, but you do need to have 2 factors. So combining both factors in a 
single password seems ok to me.

My proposal would be supported by any existing client, but the user can 
not use any saved password anymore.

Suggesting it to the IETF to result in an RFC would be the more general 
way of course.  And allow, as you suggest, clients to implement features 
making the TOTP password entry easier for the end user.

Kind regards

Mario

---
GDPR:
Personal data is provided only for this communication.
I refuse unsollicited subscriptions to mailing lists
and I refuse commercial use of this personal data.

Le 2021-03-29 10:54, Lothar Kimmeringer a écrit :

> Hi,
> 
> Am 27.03.2021 um 12:03 schrieb Mario:
> 
>> I just though about the use of a Time based One Time Password (TOTP) 
>> with pureftpd.
> 
> How should that work? Is there an RFC for 2FA in FTP? If not, I believe 
> that
> most FTP-clients out there won't be fun to use anymore.
> 
>> So the password to be submitted would be something like 
>> "FIXED_SECRET-TOTP"
> 
> The best approach here is to create a Draft for the IETF so that the 
> issue
> can be discussed by stakeholders. That way, FTP clients can add that 
> feature
> to allow easy usage, e.g. by popping up a dialog asking you for the 
> OTP-value
> and send it to the server "under the hood" like everything else that 
> happens
> on the protocol level.
> 
> If you're really concerned about security, use SFTP with public key 
> authentication
> with the private key residing on an e.g. Yubikey USB stick (i.e. an 
> external,
> hardware based device). If it has to be FTP, consider using FTPS with 
> TLS
> client authentication (but here I'm not sure if that is actually 
> supported
> by all the FTPS-clients out there) where the private key can again be
> kept externally.
> 
> Cheers, Lothar
--=_bbcb758b95b1d55da3d6cb66a618cdec--