Questions tagged [two-factor-authentication]
The two-factor-authentication tag has no usage guidance.
38
questions
0
votes
0
answers
21
views
Avoiding Google Authenticator reauthentication for existing SSH sessions on EC2 [closed]
I configured Google Authenticator for 2FA on my Almalinux 9 EC2 instance to secure SSH access. However, I'm prompted for the Google Authenticator code every time I open a new SSH session, even when a ...
0
votes
0
answers
32
views
2FA SSH authorization by a different user
Is there a way to enable two-factor (2FA) SSH authorization for multiple specified users (not everyone) when their login attempts are confirmed by a different person?
So, on the server with users a b ...
0
votes
1
answer
30
views
Auditing Microsoft Authenticator usage across Azure
I'm pushing for Microsoft Authenticator adoption across my Azure tenant. How can I definitively find out who's already installed and recently used Microsoft Authenticator ?
One not very effective way ...
0
votes
0
answers
926
views
dovecot + otp (2 factor authentication)
I've got a postfix+dovecot server. I use virtual mailboxes with mysql backend. I'm, checking for implementing 2 factor authentication. I see in dovecot auth.conf there is "otp" option. But I ...
3
votes
2
answers
3k
views
Cannot use 2FA due to <Disabled method "keyboard-interactive"> even when it is enabled
I'm trying to enable google 2FA using package fedora google-authenticator (https://github.com/google/google-authenticator-libpam).
This is my /etc/ssh/sshd_config:
# $OpenBSD: sshd_config,v 1....
0
votes
1
answer
809
views
Samba 4.16 integration with openldap 2.6 on Centos8 for 2FA
I want to setup 2factor authentication for both Linux and windows machine and want to manage the password via LDAP server.
For this, I am using LDAP(which provides TOTP functionality) to authenticate ...
0
votes
1
answer
444
views
How can I setup 2FA on non-interactive SSH connections?
I would like to add a level of security for logins to an SSH server (Ubuntu), using two factor authentication.
One particularity on how the users connect to the SSH server is that sometimes they do it ...
1
vote
1
answer
506
views
Enforcing 2FA configuration on next SSH login for every user
I have found numerous tutorials on how to enable 2FA (TOTP, RFC 6238) but is there also a way to force SSH users to configure it on the first login? (I am using OpenSSH server)
I guess I could create ...
2
votes
1
answer
556
views
SSH authentication: (public key xor password) + google authenticator code
I'm using Debian bullseye. I'm trying to set up SSH two types logins:
password + code from Google's Authenticator (if user set it, "nullok" option),
public key + code from Google's ...
-2
votes
2
answers
951
views
Active Directory 2 Factor Authentication with Smartcards
I need 2 Factor Authentication with Smartcards, so i want to login with an Password and a Smartcard. I know that Smartcards have passwords, but my company doesn't like this solution. Is there a way to ...
0
votes
1
answer
157
views
What are the best ways to implement two-factor authentication for a windows domain? [closed]
I have been asked to make our end users use two-factor authentication. I haven't had to do this before. I was wondering what the common practices are to do this nowadays? I am running windows 10 ...
1
vote
1
answer
1k
views
MS RRAS + MS VPN Client + Google Authenticator + SecureMFA
I'm running on-premise Windows Server 2019 domain, and Microsoft RRAS to allow remote users access to the local network. Remote users are using the built-in Microsoft VPN SSTP for Windows 10 clients ...
1
vote
1
answer
848
views
Security of a hardware token vs software token for two-factor authentication
Surprisingly I don't see this question on ServerFault already. I'm wondering about the pros and cons of hardware token vs software token for two-factor authentication - only in the context of ...
4
votes
0
answers
3k
views
Setup 2FA/MFA on Jenkins
I'm trying to find how to setup 2FA/MFA on users who login to Jenkins, with Google Authenticator.
Everything I'm finding is about logins to servers/git/etc, but not for the actual USERS in Jenkins.
...
0
votes
2
answers
632
views
GSuite: how to change authenticator device?
I'm GSuite admin for my domains. I have a new phone. How do I get a new QR for Google Authenticator.
I've been clicking around and don't see it anywhere.
1
vote
0
answers
80
views
Can I manage an Azure Active Directory (AD) guest user's multi-factor authentication (MFA)?
We have a guest user in our Azure Active Directory who has lost their mobile phone and is unable to sign-in using the multi-factored authentication. Is it possible for us, as admins of the Azure ...
2
votes
1
answer
762
views
Enforce 2FA on user accounts used in Cloud IAM
I have a GCP project where I work with people external to my team.
For the moment I assigned them Cloud IAM roles, in order to give them permissions to different parts of the project.
But I was ...
-2
votes
1
answer
487
views
Does iphone Touch ID count as 2FA? [closed]
Yes it does because
The customer has the physical iPhone
The customer 'is' the owner of the fingerprint
But no it doesn't because
1=>2 : If you steal the customer's iphone, the fingerprint is now ...
5
votes
2
answers
4k
views
2FA via freeRADIUS, ignoring password
I've been tasked with setting up freeRADIUS to prompt a user for their second authentication factor (eg. Google Authenticator OTP) BUT without first checking the user's password.
I'm coming into this ...
0
votes
0
answers
675
views
Is using HOTP only authorization considered weak?
I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes.
I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for casual ...
1
vote
1
answer
3k
views
Using ADFS in Windows 2012 R2 with Azure Multi-factor Authentication
Thanks in advance for reading this.
I want to require users to use the Azure mobile app for multifactor authentication when they log on to their Office 365 mailboxes. I do not need to use MFA to ...
0
votes
2
answers
1k
views
Security concerns with Microsoft Authenticator App - it can approve requests from locked iPhone?
We're using the Microsoft Authenticator App for providing Multi-factor authentication (MFA) to resources protected by Azure AD.
I noticed you can approve a request by swiping the push notification ...
1
vote
0
answers
562
views
Authenticate openvpn clients by certificate OR user/pass
I configured my openvpn server to authenticate clients with user/pass (ldap) and OTP/2FA (google authenticator). It works fine!
I have osx clients that use Tunnelblick as openvpn client and it doesn'...
-1
votes
1
answer
1k
views
RDP on premises with 2FA on Azure AD
We are looking to implement a two-factor authentication mechanism for our client's Remote Desktop servers (not running on Azure). All my clients have Azure Active Directory, so I thought I could ...
0
votes
1
answer
141
views
PAM Ignore Password Prompt Upon Successful Login
I have a CentOS 7 server that uses key based authentication for login, along with using Google Authenticator for two-factor authentication.
I am wishing to set it up, so that upon a successful login (...
0
votes
1
answer
224
views
want SSH banner to show up before OTP and password request
We use two-factor-authentication for some servers, i.e. OTP (one time password) token plus password.
I want to provide users with some informations BEFORE they are asked for their credentials. With ...
0
votes
2
answers
205
views
Implementing 2 -Factor Authentication
My company access a Third-party website, that uses a simple username + password authentication method. This vendor could restrict the application access (website) to a defined ip range.
We are trying ...
1
vote
1
answer
3k
views
Can you use the same Gemalto MFA fob for multiple AWS accounts?
I control multiple AWS accounts. I'd like to use MFA for the root logins.
I have a Gemalto hardware key fob from Amazon (docs) registered for MFA for the root account on one of them.
I tried to add ...
1
vote
0
answers
4k
views
Setting up Apache 2.4 reverse proxy with SSL and authentication both on proxy AND backend
Goal: a client authenticates against apache 2.4 reverse proxy with OTP (AuthType basic), is then forwarded to the backend server (apache 2.2) where further individual authentication is required (...
11
votes
1
answer
5k
views
U2F (YubiKey, etc) and Active Directory
I'm searching for information about how to integrate U2F (using YubiKey or similar devices) into an Active Directory Windows Domain (Will be a Windows 2016 Server). Especially I'm interested in ...
2
votes
1
answer
2k
views
is sharing the same TOTP across multiple servers any less secure?
Are there ("not insignificant") security implications to using the same OTP secret across multiple servers?
On my network, I'm running gitlab-ce, nextcloud, and LTB self-service password among a few ...
1
vote
2
answers
1k
views
Two factor authentication for password login but not for login using keys files
I configured ssh to using keys files situated in ~/.ssh to login. Now I'd like to install a two factor authentication when using password, but not required when using key files. I've seen how to ...
0
votes
1
answer
211
views
Google-2fa: How to recover an account when emergency codes are not available? [closed]
There's a server in my company which is configured with Google two-factor authentication.
A user from the company has lost his phone and can't find his emergency codes.
What can be done in order to ...
1
vote
1
answer
2k
views
How to secure AD administration with MFA
I'm evaluating an MFA solution such as Duo or Okta (any one have an opinion on that?). Adding MFA to web logins is straight forward but I want to add another layer of security to our Active Directory ...
1
vote
1
answer
724
views
linOTP to openVPN authentication ubuntu 12.04
I am working on a project in which I have to install a one-time password authentication. I have successfully installed openVPN to which I can connect without any authentication. I have installed the ...
2
votes
1
answer
4k
views
How to Configure Roundcube/Dovecot for *Effective* 2-Factor Authentication
There are several Roundcube plugins that provide two-factor authentication. However, the issue I now see is that I can still simply log in via IMAP/SMTP, without 2-FA (obviously). 2-FA is (effectively)...
1
vote
2
answers
685
views
Two factor SSH authentication on multiple servers
I am a newbie when it comes to Two factor authentication. I have the general idea of implementing two factor authentication on a single server. But I was wondering if there is a standard solution for ...
1
vote
1
answer
4k
views
google-authenticator for two-factor-authentication support with openvpn client on linux
I am trying to get openvpn client to work with google-authenticator and two-factor-authentication. I cannot alter the server in any way (i.e. I cannot do password/token concactenation via pam mods, ...