Hi all,
We started looking into OTP features provided by IPA in our facility. In
our environment, majority of our machines are located in the private
network, users access them via external-facing Gateways. We want to enforce
MFA on our gateway and allow users to have freedom SSH-ing into any
internal nodes using their regular passwords (or keys). Then add HBAC rules
for certain hosts/services who require MFA authentications using OTP (for
example, protected web resource access. NX etc) In order to achieve that,
it seems to me we need turn on both 'password' and 'otp' for individual
users or globally. This will then trigger 'password' for SSH and 'otp'
auth
for WebApps/NX and so on.
However when I looked at the online document @
https://www.freeipa.org/page/V4/OTP#Implementation , it stated "*Mixing the
"password" and "otp" user auth types should not be used*", I
wonder why
"mixing" is not recommended, and what is the downside if we implement this
way(in order to achieve what we're trying to do), or any other better
strategies in this case?
Can some advice? Thank you in advance!
Mizuki