Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Google released it's Google Authenticator Module with a PAM interface.

Have someone experience on implementing this into an imap server?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

The IMAP protocol can use SASL for authentication, which explicitly can support OTP. The other two answers are wrong on this account. SASL can further be extended to other authentication mechanisms.

However, both the server and client software must support the SASL Mechanism for it to work, and OTP isn't supported by any software that I'm aware of (not that it doesn't exist, I just don't know of any).

share|improve this answer
add comment

If this system implements a challenge-response-system, you will not have a chance to do this with IMAP, as IMAP lacks any support for such a system, as Luca already said.

If there is an option for a strictly time-based OTP generation (you enter your password into your OTP generator, which generates a time-dependent OTP which serves as IMAP login password) or something similar, it should be kind of easy: Just configure your IMAP server to authenticate against this PAM module and you should be done.

share|improve this answer
2  
IMAP supports SASL, see RFC 4959. SASL support OTP, see RFC 2444. For more information on SASL see RFC 2222. Software support might be lacking, but the standard is there. –  Chris S Nov 20 '11 at 21:16
add comment

Google Authenticator is an OTP (one time password) implementation.

With OTP, a challenge is presented to the user who must enter it along with a passphrase (something you know) into an OTP calculator (something you have, often a smart phone) to generate the response.

edit: As mentioned by Chris S, IMAP supports SASL and SASL supports OTP... but I'm not aware of servers or clients that implement it.

share|improve this answer
    
Maybe a custom web interface would do the trick... –  cedivad Nov 20 '11 at 11:20
    
Are you talking IMAP or webmail systems (which are usually only front ends to IMAP)? If you want allow your clients to use classic mail clients, this won't work. –  SvW Nov 20 '11 at 15:05
1  
IMAP supports SASL, see RFC 4959. SASL support OTP, see RFC 2444. For more information on SASL see RFC 2222. Software support might be lacking, but the standard is there. –  Chris S Nov 20 '11 at 21:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.