1

Google released it's Google Authenticator Module with a PAM interface.

Have someone experience on implementing this into an imap server?

3 Answers 3

3

The IMAP protocol can use SASL for authentication, which explicitly can support OTP. The other two answers are wrong on this account. SASL can further be extended to other authentication mechanisms.

However, both the server and client software must support the SASL Mechanism for it to work, and OTP isn't supported by any software that I'm aware of (not that it doesn't exist, I just don't know of any).

2

If this system implements a challenge-response-system, you will not have a chance to do this with IMAP, as IMAP lacks any support for such a system, as Luca already said.

If there is an option for a strictly time-based OTP generation (you enter your password into your OTP generator, which generates a time-dependent OTP which serves as IMAP login password) or something similar, it should be kind of easy: Just configure your IMAP server to authenticate against this PAM module and you should be done.

1
  • 2
    IMAP supports SASL, see RFC 4959. SASL support OTP, see RFC 2444. For more information on SASL see RFC 2222. Software support might be lacking, but the standard is there.
    – Chris S
    Nov 20, 2011 at 21:16
0

Google Authenticator is an OTP (one time password) implementation.

With OTP, a challenge is presented to the user who must enter it along with a passphrase (something you know) into an OTP calculator (something you have, often a smart phone) to generate the response.

edit: As mentioned by Chris S, IMAP supports SASL and SASL supports OTP... but I'm not aware of servers or clients that implement it.

3
  • Maybe a custom web interface would do the trick...
    – cedivad
    Nov 20, 2011 at 11:20
  • Are you talking IMAP or webmail systems (which are usually only front ends to IMAP)? If you want allow your clients to use classic mail clients, this won't work.
    – Sven
    Nov 20, 2011 at 15:05
  • 1
    IMAP supports SASL, see RFC 4959. SASL support OTP, see RFC 2444. For more information on SASL see RFC 2222. Software support might be lacking, but the standard is there.
    – Chris S
    Nov 20, 2011 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .