Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a Ubuntu virtual server that I use for webhosting and other stuff. I've been thinking about moving mail onto it, but I'd like to secure it more against the threat of losing my smartphone. Google has 2 step verification systems that allow devices to have their own password.

Is there a standard UNIX-y way of allowing one account to have multiple credentials, so that I can revoke one later without revoking all of them?

share|improve this question
    
did you ever figure this out? i don't want to switch to the passdb scheme for my Dovecot server, but would like to use allow application specific passwords for my mail accounts using PAM... –  RapidWebs Jun 14 at 6:43
add comment

2 Answers

With PAM everything is possible. That's why "P" stands for pluggable. You can use multi-factor authentication, one time passwords, iris scanners and whatever you like (and for what a plug-in exists).

One of the plug-ins is Google Authenticator for two factor authentication. See this post for instructions and source code: http://www.mnxsolutions.com/security/two-factor-ssh-with-google-authenticator.html

share|improve this answer
    
the title clearly says "application specific password", which, for example, is used with Google authenticator to allow totally separate passwords for mail. this does not answer the question –  RapidWebs Jun 14 at 6:40
    
everything is not possible; unless you are willing to write a C modules for PAM, you are bound to what actually exists! –  RapidWebs Jun 14 at 6:42
add comment

Is there a standard UNIX-y way of allowing one account to have multiple credentials, so that I can revoke one later without revoking all of them?

Depending on how you access your system (and use these accounts) you could do that very easily with SSH and key based authentication.

The valid credentials (public keys) are stored in ~/.ssh/authorized_keys or ~/.ssh/authorized_keys2. If one user shouldn't be able to access the related user account any more, just remove their key from authorized_keys.

share|improve this answer
    
like the above answer, he wants application specific passwords for mail server. –  RapidWebs Jun 14 at 6:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.