nextcloud / nextcloud/nextcloudpi
Add multi factor authentication method(s) for SSH and ncp admin panel
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 2.9k
- Forks
- 318
- PR merge metrics
- No merged PRs in 30d
Description
Description
Nowadays, MFA is considered a must-have for any kind of administrative access to web services, at least in a professional environment. Since suitable PAM modules exist, it should be easy to give users the option to enable MFA methods for SSH access as well as the admin panel (since it's based on system user authentication/pam as well).
I'm currently looking into this myself and if it's feasible with as little effort as I expect, I'll create a PR, provided that there are no objections to the idea.
Example
Some of the available pam libraries that could be used are:
- libpam-google-authenticator (which can not only be used with the official google-authenticator app, but also 3rd party apps)
- libpam-otpw
- libpam-yubico
However, I haven't evaluated any of these options in-depth yet.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names SSH access, the ncp admin panel, and PAM as the areas to investigate, but no files or tests. Start by evaluating the listed PAM libraries and whether they support both authentication paths; done would require a decided MFA approach for SSH and the admin panel.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100