Feature #12546
open
Add 2FA Support to pfSense Plus Local Database Authentication
0%
Description
To eliminate the reliance on unsupported packages like freeRADIUS for making this work, we should add the capability to the built-in user database in pfSense for time-based tokens. This could be "bolted on" to the end of passwords similar to how other options accomplish this for OpenVPN or IPSec VPNs, but we may be able to add a field to the webConfigurator login for 2FA.
Updated by
Updated by Michael Pace over 2 years ago
Hello,
This would be hugely helpful. Insurance companies are starting to require we implement 2FA across the board. Having it natively in pfSense would save a great deal of frustration.
Updated by Kris Phillips over 2 years ago
Further expounding on this, it appears that Viscosity has native capability to add prompts in the client config.
auth-user-pass
static-challenge "Please provide your One-Time Passcode" 0
This can be "merged" into the password field with a bit of finagling and scripting. May be a way to add a backend for this in pfSense.
Updated by jeffrey Smith about 1 year ago
Can we please add support for passkeys into default accounts for pfsense.
Apple and Microsoft are adding native support to their OS's
https://developer.apple.com/passkeys/
https://www.bleepingcomputer.com/news/microsoft/windows-11-is-getting-a-built-in-passkey-manager-for-windows-hello/
Android 14 will have support as well
https://9to5google.com/2023/03/01/android-14-passkey-dashlane/
https://github.com/herrjemand/awesome-webauthn There are php and go server side implementations here already
The benefits of this is that it is a phishing resistant form of authentication, cant be keylogged and much safer then having just password.
Updated by Kris Phillips about 1 year ago
jeffrey Smith wrote in #note-4:
Can we please add support for passkeys into default accounts for pfsense.
Apple and Microsoft are adding native support to their OS's
https://developer.apple.com/passkeys/
https://www.bleepingcomputer.com/news/microsoft/windows-11-is-getting-a-built-in-passkey-manager-for-windows-hello/Android 14 will have support as well
https://9to5google.com/2023/03/01/android-14-passkey-dashlane/https://github.com/herrjemand/awesome-webauthn There are php and go server side implementations here already
The benefits of this is that it is a phishing resistant form of authentication, cant be keylogged and much safer then having just password.
This should probably be a separate feature request, since this redmine is specific to TOTP, Cert, or Hardware key-based 2FA. I'll generate one shortly.
Updated by Kris Phillips about 1 year ago
Redmine created for separate feature request: https://redmine.pfsense.org/issues/14743