Using MFA for SFTP Proxy

kron pam ’s built in mfa can be used as an enhanced security level for sftp proxy when users open an sftp client (winscp or filezilla), they are prompted to enter their kron pam credentials to connect to the sftp proxy if mfa is activated for sftp proxy for filezilla connections after users log in successfully using their credentials, the following screen opens, where users are asked for an mfa token for winscp connections kron pam credentials and mfa token are entered on the same screen also, sftp clients have their own configurations for mfa usage for instance, the logon type should be selected as interactive to enable mfa for a user see figure mfa usage on filezilla below only users in enabled user groups can use mfa for sftp connections to enable mfa use for the user group, please refer to the section enabling multi factor authentication (mfa) docid\ y3vavtwkwrz1wleyurgxc to set up mfa for sftp connections, follow the steps below admin and users must have the qr code, installed the kron pam mobile app, scanned the qr code with the mobile app, and mfa must be enabled for the user group that will be using mfa for ssh connections establish an ssh connection to kron pam as the pamuser user edit the nsso properties file under /u01/sftp proxy/conf/ directory and add the following configurations in this file nsso connection initial otp enabled=true nsso connection initial otp cache enabled=true nsso connection initial otp cache sec=300 the first command enables mfa the second command sets up otp caching, and the third one sets the cache value to 300 seconds it means that users logging in with otp won't be asked for any token for the next 300 seconds, even if they disconnect and connect again after setting the parameters, restart the sftp proxy by running the following command systemctl restart pam sftp after these settings, users belonging to an mfa enabled user group will be asked for a token on sftp client when logging in to kron pam over the 3333 port