Take the 2-minute tour ×  I'm wondering if there is some kine of
2 factor authentication module which supports PAM. My
dovecot(PAM), postfix(SASL) and openssh authenticate via PAM to
the system users. I would like to have it do 2 factor
authentication, maybe via yubikey, google authenticator or
whatever. And also, how would my mail client handle that?
share|improve this question  2 Answers 2  up vote 2 down vote
accepted  Really, you want to choose the proper authentication
protocol that is supported by PAM, the services you want to
protect and the broadest number of two-factor authentication
servers.  Radius is the answer.  All major two-factor
authentication systems support radius. Radius is supported in
PAM through the pam-radius plugin. Radius will also allow you to
proxy the requests through freeradius (or NPS on AD) which can
then perform authorization against your directory. (Meaning that
you have one location to disable users.)  We have a number of
tutorials that should help: a couple on pam-radius: