[pve-devel] Two-Factor Authentication

[Eric Blevins]

>
> I have made some initial test and uploaded that code:
>
> https://git.proxmox.com/?p=pve-access-control.git;a=commitdiff;h=ab652a80189a1498caba8c7f3f2641affe9ec3bf

The URL should default to https but allow configuring it in
/etc/pve/datacenter.cfg

If an attacker was able to intercept the request they could utilize
the OTP to gain access or trick Proxmox into thinking an invalid OTP
is valid.
https cert validation will (theoretically) prevent such attacks.

I have not had issues with certificate validation provided the
ca-certificates package is installed.