samba - Nov 2019 - samba login with U2F token

Dear all,
I did try to google search the archives [1] but cannot find any
information on this.

Would it be possible to somehow implement a passwordless (or as a 2FA)
to login to a remote samba (linux server)?

Any suggestions greatly appreciated,
Greg

1. https://lists.samba.org/archive/samba/

You might want to look at these : 

Windows: 
https://www.technorms.com/46293/enable-microsoft-two-step-authentication-in-windows-10
https://www.yubico.com/passwordless/ 
Or Phone: 
https://www.yubico.com/products/yubikey-for-mobile/

Setup: 
https://support.yubico.com/support/solutions/articles/15000006456-yubikey-smart-card-deployment-guide

Ssh: 
https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04
This works fine, simpel to setup, im using it on jessie/stretch/buster/bionic

Samba:
https://wiki.samba.org/index.php/Samba_AD_Smart_Card_Login


https://freies-franken.org/index.php/2-uncategorised/2-2fa-mit-sssd-freeradius-google-authenticator-samba-ad-und-pfsense
But in this one i would like to see this with winbind and not sssd. 
Or 
https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy 

Some things to read and think about it.
But looking at above, yeah, what you want should be possible. ;-) 


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Greg 
> Marshall via samba
> Verzonden: donderdag 7 november 2019 13:07
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] samba login with U2F token
> 
> Dear all,
> I did try to google search the archives [1] but cannot find any
> information on this.
> 
> Would it be possible to somehow implement a passwordless (or as a 2FA)
> to login to a remote samba (linux server)?
> 
> Any suggestions greatly appreciated,
> Greg
> 
> 1. https://lists.samba.org/archive/samba/
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On 07/11/2019 12:58, L.P.H. van Belle via samba wrote:
> You might want to look at these :
>
>
https://freies-franken.org/index.php/2-uncategorised/2-2fa-mit-sssd-freeradius-google-authenticator-samba-ad-und-pfsense
> But in this one i would like to see this with winbind and not sssd.
That one is interesting, it says '2019' at the bottom, but it also says 
to use '--use-ntvfs' during the provision, but this hasn't been an 
option for quite a few years now.

It should be fairly easy to use winbind instead of sssd, but I couldn't 
test it because I do not use radius etc ;-)

Rowland