Home / server / Questions / 332895
Accepted
cedivad
Asked: 2011-11-21 01:01:05 +0800 CST

Using Google Authenticator with an IMAP server

  • 772

Google released it's Google Authenticator Module with a PAM interface.

Have someone experience on implementing this into an imap server?

imap google-authenticator

3 Answers

  1. Best Answer

    The IMAP protocol can use SASL for authentication, which explicitly can support OTP. The other two answers are wrong on this account. SASL can further be extended to other authentication mechanisms.

    However, both the server and client software must support the SASL Mechanism for it to work, and OTP isn't supported by any software that I'm aware of (not that it doesn't exist, I just don't know of any).

    • 3

  2. If this system implements a challenge-response-system, you will not have a chance to do this with IMAP, as IMAP lacks any support for such a system, as Luca already said.

    If there is an option for a strictly time-based OTP generation (you enter your password into your OTP generator, which generates a time-dependent OTP which serves as IMAP login password) or something similar, it should be kind of easy: Just configure your IMAP server to authenticate against this PAM module and you should be done.

    • 2

  3. Google Authenticator is an OTP (one time password) implementation.

    With OTP, a challenge is presented to the user who must enter it along with a passphrase (something you know) into an OTP calculator (something you have, often a smart phone) to generate the response.

    edit: As mentioned by Chris S, IMAP supports SASL and SASL supports OTP... but I'm not aware of servers or clients that implement it.

    • 0