OTP login without password

[argon3030]

Hello roundcubies, I'm trying to get a specific configuration working and having some issues:

I see that roundcube uses IMAP authentication for user logins, but I'm trying to protect against keylogger attacks, i.e. logging in from a public kiosk or internet cafe or other untrusted client machine which very well may have a key stroke logger on it.

So naturally, OTP is of interest, since it's one time use, and it expires after a short duration.  I was successful in configuring the twofactor_gauthenticator plugin, with the FreeOTP app on my phone, so I can log in using OTP - however this plugin requires you to enter your normal IMAP user password along with the OTP.  So that's no good, because if someone captures the IMAP password, they can bypass Roundcube altogether and login directly via IMAP.

Next I tried the http_authentication plugin, which passes credentials to Roundcube, but that doesn't achieve the goal either, as you still have to enter your IMAP login to the browser, which then passes it to Roundcube.

The perfect solution would be twofactor_gauthenticator but without the requirement to enter the IMAP password.  That doesn't appear to be supported though?

Does anyone know how I can authenticate users to Roundcube without having to type the IMAP password?

Thank you

[SKaero]

You could devlop something that would do that, Roundcube would still need the password so you'd have to store that in the database and the retrieve it when the OTP was validated correctly.

[argon3030]

You could devlop something that would do that, Roundcube would still need the password so you'd have to store that in the database and the retrieve it when the OTP was validated correctly.

Ah, ok, I'm not a PHP developer unfortunately.  That would be great if someday a Roundcube user could be authenticated via LDAP or via local /etc/passwd, with the IMAP credentials saved in the database.

[SKaero]

You could setup the mail to authenticate that way but you'd still have store the password in Roundcube. The technically best way to do it would be to have the mail server authenticate via OTP which wouldn't require any changes to Roundcube but you'd have to be able to make that system for the mail server.