<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>One obviously missing, is a SmartCard, loaded with SSL keys & certificates, that should be reachable through P11 (or pkcs11) library...</div>
<div><br>
</div>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0 0 0">
<div><br>
<b>From: </b>"Stefan Baur" <<a href="mailto:X2Go-ML-1@baur-itcs.de">X2Go-ML-1@baur-itcs.de</a>><br>
<b>Date:</b> Friday, 24 April 2020 at 18:44:51<br>
<b>To: </b>"x2go-user@lists.x2go.org" <<a href="mailto:x2go-user@lists.x2go.org">x2go-user@lists.x2go.org</a>><br>
<b>Subject:</b> Re: [X2Go-User] X2Go, MFA and Duo?</div>
</div>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Am 24.04.20 um 18:01 schrieb James M. Pulver:<br>
> Has anyone ever used X2Go Client (windows, linux, mac) with some sort of MFA that works in SSH? Duo and PortalGuard both support SSH MFA with either a "line client" or easier IMHO an appended password. I was wondering if Duo with the appended code to the
password field might work? Also, is there any plans to add a second password field to the clients al la Cisco AnyConnect etc?<br>
<br>
X2GoClient has out-of-the-box support for several 2FA solutions:<br>
<br>
<<a href="https://code.x2go.org/gitweb?p=x2goclient.git;a=blob;f=src/sshmasterconnection.cpp;h=8b59fe79f275e83b34e4bfb038dd9318b78389c1;hb=HEAD#l52">https://code.x2go.org/gitweb?p=x2goclient.git;a=blob;f=src/sshmasterconnection.cpp;h=8b59fe79f275e83b34e4bfb038dd9318b78389c1;hb=HEAD#l52</a>><br>
<br>
53 "Verification code:", // GA<br>
(<a href="http://github.com/google/google-authenticator">http://github.com/google/google-authenticator</a>)<br>
54 "One-time password (OATH) for", // OATH<br>
(<a href="http://www.nongnu.org/oath-toolkit/pam_oath.html">http://www.nongnu.org/oath-toolkit/pam_oath.html</a>)<br>
55 "passcode:", // MOTP<br>
(<a href="http://motp.sourceforge.net">http://motp.sourceforge.net</a>)<br>
56 "Enter PASSCODE:", // SecurID<br>
57 "YubiKey for" // YubiKey<br>
(<a href="https://en.wikipedia.org/wiki/YubiKey">https://en.wikipedia.org/wiki/YubiKey</a>)<br>
<br>
If Duo needs an appended code, it should work out of the box as well; if<br>
not, it will need to use either one of the prompts above to work out of<br>
the box, or one unique to Duo that we can add to a future client release.<br>
<br>
Frankly, I don't see a reason for the hype around Duo - what does it do<br>
that any of the established 2FA solutions can't do?<br>
When we looked at that after a customer had asked us about it, all it<br>
seemed to do was add a single point of failure, as it needed to "phone<br>
home" to a central Duo server (not under the customer's control) before<br>
being able to grant access. Block/sabotage that connection and you've<br>
essentially DoS'ed the system.<br>
Solutions based on Google Authenticator, or more generally, OATH, need<br>
no such external connection. I would assume the same goes for MOTP,<br>
YubiKey and SecureID.<br>
My personal favorite at the moment is Google Authenticator, which,<br>
despite what its name might suggest, does not "phone home" to Google.<br>
And you don't need to run the actual Google-Authenticator-App on your<br>
phone, either - any open source OTP app that supports TOTP OATH will do.<br>
<br>
Not sure what Cisco AnyConnect does or why we should add a second<br>
password field on the default login screen - that doesn't seem to make<br>
sense. All that would do is confuse users that don't use 2FA.<br>
And we don't know if a server uses 2FA or not until after we've provided<br>
a username and password to it, so there's no way of determining whether<br>
or not we should present a field for the 2FA code on the login screen.<br>
Hence, the popup for it.<br>
<br>
-Stefan<br>
<br>
-- <br>
BAUR-ITCS UG (haftungsbeschränkt)<br>
Geschäftsführer: Stefan Baur<br>
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364<br>
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243<br>
_______________________________________________<br>
x2go-user mailing list<br>
x2go-user@lists.x2go.org<br>
<a href="https://lists.x2go.org/listinfo/x2go-user">https://lists.x2go.org/listinfo/x2go-user</a><br>
</div>
</span></font><br>
Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid
voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.
<br>
<br>
This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind
resulting from the risks inherent in the electronic transmission of messages.
</body>
</html>