Re: Sv: 2FA/MFA with IMAP & postfix/submission

[Sebastian Nielsen]

Problem is that not many client support it - especially mobile ones.So wireguard VPN is the way to go, much simpler for the users.
-------- Originalmeddelande --------Från: Rick Romero <rick at havokmon.com> Datum: 2021-07-15  17:04  (GMT+01:00) Till: dovecot at dovecot.org Ämne: Re: Sv: 2FA/MFA with IMAP & postfix/submission 
Quoting Alex <mysqlstudent at gmail.com>:

Hi,

Unfortunately the best way to do multifactor authentication today is to use OAUTH2, which isn't currently supported for own installations. Or you can use client certs.

If you want to use some kind of MFA with tokens, you end up having to feed your token all the time. So the best option, for now, is device passwords.

Client certs appears to be a good solution.

What's the process for managing them with more than a hundred client accounts?

I believe the problem they are trying to solve is hacked accounts from
compromised passwords. Does client certs solve that problem?
Client certs would solve that - but you'll need some management around it (creation/deployment/renewal/device changes/etc). The easiest method is to run MDM and PKI infrastructure, but with 100 clients I kinda doubt that's in place and I wonder if they have the budget for it.

Another option, not open source, but if you engage Recorded Future, you can get a report and notifications of password compromises, and then take action on that info (ie, force affected user to change password).

Alternatively, and free, don't use the email address as the username for authenticaiton, use some other generic ID.

Rick

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20210715/13ca7174/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5715 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://dovecot.org/pipermail/dovecot/attachments/20210715/13ca7174/attachment-0001.p7s>