SSH has supported MFA for decades: https://www.google.com/search?q=ssh+mfa
Re:A Slack clone in 5 lines of bash
by themoonisachees on Wednesday July 05, 2023 @01:06PM
(#36603414)
If we really wanted MFA, we could roll a PAM module, and whatever pushes SSH authorized keys could also push MFA seeds. But IMO this would protect against very unusual attacks and annoy ssh agents users everywhere.
Re:A Slack clone in 5 lines of bash
by throwawaymobule on Wednesday July 05, 2023 @05:53PM
(#36607693)
Doing MFA for ssh like that would satisfy some compliance issues, wherever that matters. Probably key+pass.
* Roll it themselves, maintain the database and all that jazz * Delegate it to the (very robust, very mature) Linux user authentication stuff
Ever since reading that I've found myself wondering why more apps don't simply use SSH keypairs for authentication, given that they're already such a battletested mechanism. I get the whole "no MFA!" argument, but still.