Hi all,
We started looking into OTP features provided by IPA in our facility. In our environment,
majority of our machines are located in the private network, users access them via
external-facing Gateways. We want to enforce MFA on our gateway and allow users to have
freedom SSH-ing into any internal nodes using their regular password (or keys). Then add
HBAC rules for certain hosts/services who require MFA authentications using OTP (for
example, protected web resource access. NX etc) In order to achieve that, it seems to me
we need turn on both 'password' and 'otp' for individual users or
globally. This will then trigger 'password' for SSH and 'otp' auth for
WebApps/NX and so on.
However when I looked at the online document @
https://www.freeipa.org/page/V4/OTP#Implementation , it stated "Mixing the
"password" and "otp" user auth types should not be used", I
wonder why "mixing" is not recommended, and what is the downside if we implement
this way(in order to achieve what we're trying to do), or any other better strategies
in this case?
Can some advice? Thank you in advance!
Mizuki