What do you regard as “expensive”?
Strong 2FA with world-wide acceptable PKI can be obtained for €70 a piece..
If you can afford the time, and willing to do your own CA, you can lower it to €15 a piece.

The first can be obtained when applying for Estonian E-resident, https://learn.e-resident.gov.ee/hc/en-us/articles/360000625098-Why-become-an-e-resident

second one by buying smart cards at aventra.fi https://aventra.fi/webshop/index.php?route=product/product&product_id=87

From: "Dan Mahoney (Gushi)" <danm@prime.gushi.org<mailto:danm@prime.gushi.org>>
Date: Wednesday, 6 October 2021 at 23:18:51
To: "kerberos@mit.edu" <kerberos@mit.edu<mailto:kerberos@mit.edu>>
Subject: 2FA with krb5

All,

We use Kerberos but NOT LDAP at the day job.

We'd like to be able to leverage 2fa for some services (admins) and some
services (ssh logins) but not have to pump a 2fa code into, say, our mail
applications. Is there a way to make the acquisition of a TGT (for GSSAPI
authentication) vs Password Authentication require 2fa?

That's complication number one.

Complication number 2 is something like "SecurID is *expensive* for a
fairly small (<10) admin team."

Is there any reasonable support for off-the-shelf TOTP or HOTP
authenticators, i.e. google authenticator or whatnot? If so, is there
support to have a user have *multiple* available authenticators, such that
one can be expired and others not?

Googling this all gets me a bunch of (some older, some newer articles
about the varying states of SPAKE and the like), and...a whole bunch of
ads now being shown for startups that want to do it differently but I'm
SURE no way to integrate with this.

The final problem, of course, is that if I make all my KDC's 2fa-aware on
their own, there's no communication of double-use of a token, unless I
centralize things, which breaks the purpose of having geo-diverse KDC's.
I don't suppose the kerberos db replication mechanism has anything that
can also share this state?

This is all pie-in-the-sky stuff, but practical answers "just an FAQ" are
hard to find.

-Dan

--

--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
FB: fb.com/DanielMahoneyIV
LI: linkedin.com/in/gushi
Site: http://www.gushi.org
---------------------------

________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.