<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div style="font-family: Verdana;font-size: 12.0px;">
<div>
<div>Hi Mike,</div>
<div> </div>
<div>our employees have to authenticate a second time in the web applications, but the cookies have long lifetimes, so it is not really annoying.</div>
<div> </div>
<div>We really need authentication of individual TLS connections (as first step of authentication), because our main problem is that some of this web applications are quite old and the server software reached the end of support date already a long time ago. So we are using the reverse HTTPS proxy service of our firewall to prevent direct access to this problematic server. So "bad guys" in the internet are only able to "play around" with the up-to-date reverse HTTPS proxy and are not able to try bad things with the old server software and the old web applications. As long as the "bad guys" will not find a valid https-Password they are not able to search for security bugs in the application server or in the web application itself. This is (sadly) at the moment the only solution we have which fits to our time and money budget.</div>
<div> </div>
<div>stunnel came to my mind, because I did something similar before in another project with client certificate https authentication. This solution was based on stunnel on the http-server-side and it was really easy to configure stunnel for this task! But client certificates are no option in this case. It has to be TOTP.</div>
<div> </div>
<div>So your suggestion is to use some dedicated reverse HTTPS proxy in combination with i.e. privacyIDEA, right? I guess this will get much more complicated then the client certificate based https-authentification based on stunnel before, but I will try my very best :-)</div>
<div> </div>
<div>Best regards,</div>
<div>Martin</div>
<div>
<div style="margin: 10.0px 5.0px 5.0px 10.0px;padding: 10.0px 0 10.0px 10.0px;border-left: 2.0px solid rgb(195,217,229);">
<div style="margin: 0 0 10.0px 0;"><b>Gesendet:</b> Samstag, 31. Oktober 2015 um 00:37 Uhr<br/>
<b>Von:</b> "Michal Trojnara" <Michal.Trojnara@mirt.net><br/>
<b>An:</b> stunnel-users@stunnel.org<br/>
<b>Betreff:</b> Re: [stunnel-users] One Time Password for https two factor authentication</div>
<div>-----BEGIN PGP SIGNED MESSAGE-----<br/>
Hash: SHA256<br/>
<br/>
Hi Martin,<br/>
<br/>
As far as I understood your description what you need is additional<br/>
authentication of web application sessions, rather than authentication<br/>
of individual TLS connections.<br/>
<br/>
I guess you need a specialized reverse HTTP(S) proxy. Stunnel is a<br/>
generic TCP/TLS proxy. It has no understanding of HTTP and web<br/>
applications.<br/>
<br/>
Best regards,<br/>
Mike<br/>
<br/>
On 29.10.2015 21:11, hamburg-barmbek@gmx.de wrote:<br/>
> at the moment we’re using a https-Wrapper-Service in our<br/>
> firewall-appliance to manage restricted access to some of our<br/>
> websites. For two factor authentication we’re using privacyIDEA as<br/>
> radius server. Most of our users/employees are using for one time<br/>
> password generation the "Google Authenticator" App. Some are using<br/>
> "Feitian C-200" (but I do not like the C-200, because I do not know<br/>
> how to program a new seed by myself). Both generators are based on<br/>
> the quite simple TOTP Algorithm<br/>
> (<a href="https://tools.ietf.org/html/rfc6238" target="_blank">https://tools.ietf.org/html/rfc6238</a>). The https-password is a<br/>
> combination of a fixed password directly followed by the TOTP<br/>
> password.<br/>
><br/>
> Because we want to change the firewall-appliance, we have to find a<br/>
> new solution. Is it possible (or is it a planned feature for the<br/>
> near future) to handle authentication in stunnel with radius? Or<br/>
> even better/simpler, is TOTP supported by stunnel? I wasn't able to<br/>
> find anything like this in the documentation.<br/>
><br/>
> Regards, Martin<br/>
><br/>
><br/>
><br/>
><br/>
> _______________________________________________ stunnel-users<br/>
> mailing list stunnel-users@stunnel.org<br/>
> <a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br/>
><br/>
-----BEGIN PGP SIGNATURE-----<br/>
Version: GnuPG v2<br/>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br/>
<br/>
iQIcBAEBCAAGBQJWM/8xAAoJEC78f/DUFuAUuLAQAKiUHGo3l+FZi8xcEm/8Il1A<br/>
Ht9CLNXlrKRRtrbRPNK3GloTaMtcPWvYl18UXvk3X0wBIC9ADLUU0RsBCxwJpqNC<br/>
uaxoBS8mlxVz7vuSygKuSIIajQElY/zQD8r5LecOCxlM1sQqflplMwu7by1X3nK5<br/>
1kxoy9wbt/JARFLcZG3tBd2m3nJEBh6VBD4q4L9yYwU92LrpoDlP47TZg+clMz/w<br/>
8sNgQj6TG3srhF1k6kHM7Ggi3/y4oJIcyF1PhDFROKLN6Sx1LukqcO3JDLTqfiF7<br/>
6OBQPCsOE4iXN0Urt0ldnOKivdikLHYUPCdAM/YUhafCagD4Lq6XDqIjZFcfxCNo<br/>
TYayROXZJPQPOvDvsLF9tM//luQrEV36UHjqWAvSl9l3cyZj3TqqSvyl+dh1VMke<br/>
0ru8vcaFsnoYDufGFOJG1byVj2jsnjTuYmD7Dwr+pocfjwIvbRXuh5+ayOZaUHGt<br/>
iEbreZar+x4Ok/yDY9DRCSjYgBIu5dcQNTSr7TvD/PcngdPV2QIAI1IwnuJzKPGx<br/>
zQBm1BoghDN0EWvDRXA6HbsyuiB0ecTIRAuHA8acM0kYQyXLoan7wpwAL7bhNyoR<br/>
3vj6pc1lypMdkgv5ke9aRIsQxxIX6PVJq7j66Z77sM2I6CnuoW4YXH9tqGIvawBx<br/>
WSOxj81HY+x6+bwLYVtf<br/>
=KtpX<br/>
-----END PGP SIGNATURE-----<br/>
_______________________________________________<br/>
stunnel-users mailing list<br/>
stunnel-users@stunnel.org<br/>
<a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a></div>
</div>
</div>
</div>
</div>
<div> </div>
<div class="signature"> </div></div></body></html>