Am 24.04.20 um 18:01 schrieb James M. Pulver:

Has anyone ever used X2Go Client (windows, linux, mac) with some sort of MFA that works in SSH? Duo and PortalGuard both support SSH MFA with either a "line client" or easier IMHO an appended password. I was wondering if Duo with the appended code to the password field might work? Also, is there any plans to add a second password field to the clients al la Cisco AnyConnect etc?

X2GoClient has out-of-the-box support for several 2FA solutions:

<https://code.x2go.org/gitweb?p=x2goclient.git;a=blob;f=src/sshmasterconnection.cpp;h=8b59fe79f275e83b34e4bfb038dd9318b78389c1;hb=HEAD#l52>

53 "Verification code:", // GA (http://github.com/google/google-authenticator) 54 "One-time password (OATH) for", // OATH (http://www.nongnu.org/oath-toolkit/pam_oath.html) 55 "passcode:", // MOTP (http://motp.sourceforge.net) 56 "Enter PASSCODE:", // SecurID 57 "YubiKey for" // YubiKey (https://en.wikipedia.org/wiki/YubiKey)

If Duo needs an appended code, it should work out of the box as well; if not, it will need to use either one of the prompts above to work out of the box, or one unique to Duo that we can add to a future client release.

Frankly, I don't see a reason for the hype around Duo - what does it do that any of the established 2FA solutions can't do? When we looked at that after a customer had asked us about it, all it seemed to do was add a single point of failure, as it needed to "phone home" to a central Duo server (not under the customer's control) before being able to grant access. Block/sabotage that connection and you've essentially DoS'ed the system. Solutions based on Google Authenticator, or more generally, OATH, need no such external connection. I would assume the same goes for MOTP, YubiKey and SecureID. My personal favorite at the moment is Google Authenticator, which, despite what its name might suggest, does not "phone home" to Google. And you don't need to run the actual Google-Authenticator-App on your phone, either - any open source OTP app that supports TOTP OATH will do.

Not sure what Cisco AnyConnect does or why we should add a second password field on the default login screen - that doesn't seem to make sense. All that would do is confuse users that don't use 2FA. And we don't know if a server uses 2FA or not until after we've provided a username and password to it, so there's no way of determining whether or not we should present a field for the 2FA code on the login screen. Hence, the popup for it.

-Stefan

-- BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243