2FA or two-factor authentication with cockpit

So you have a problem if you didn’t write doen the recovery code?
I was offfered to use this system for my VPS provider account. Just because of this, I am very reluctant to start using this… I am just scared to get locked out…

2FA is a modern way, a lot of provider of services propose it, it won’t be enabled by default.

If you have lost your login+password+token, then you can use ssh and the shared certificate (without password).

If you have lost your login, your password, your token, your shared certificate, maybe it was not your day :smiley:

2 Likes

thinking on it you still have the physical console of your server, even if it is virtual, except if you have enabled 2FA with Proxmox of course.

Nothing physical on a VPS in a datacenter 400km away… :astonished: although, there is an option for VNC access provided by the hosting provider… but frankly, I don’t want to rely on such a last resort…

1 Like

Hi,

OTP is enabeld, but i have only the QR Code. There are no recovery codes. What is wrong?

Regards

Uwe

1 Like

You have probably installed an old version from the pull request, however travis is failed actually we need to wait @davidep is back

1 Like

OK, thanks…

The build should good now

1 Like

Hi,

and how can i get the good build?

Regards

Uwe

This is the PR, each time test the last build

https://github.com/NethServer/nethserver-cockpit/pull/191

1 Like

now to enable 2FA we have to validate the token you have flashed on your mobile…

cheers :innocent:

@davidep @giacomo I would be pleased some reviews

1 Like

Tested with a raspberry and an android mobile and it just worked!

  • Login with freeotp code works, wrong code correctly rejected
  • Login with recovery code works, second try with same code correctly rejected

Is there a possibility to refresh the recovery codes?

Cosmetic (and most likely cockpit related): I had to logout/login to see the new otp settings, just refreshing browser wasn’t enough (Firefox).

2 Likes

I am not sure, I need to check with oathtools, or maybe with the JS library otplib

I am not sure to understand, I recall something good with chromium, need to test

Thank mr markus

2 Likes

thank @giacomo

2 Likes

Hi.

looks good, but dont work for me. Where can i find the x-digit code for verification?
Maybe I can’t see the forest because of the many trees.

Regards

Uwe

Install freeOTP on your mobile phone and scan the qr code

I have done it several times.

Could you explain what is your issue please ?

My issue is to validate the QR code token in Step 3.
I dont now where he is. When i type the first OTP in the field and press settings.test_token, i received a red message that means there is an Token Validation Error.

For a better understanding: After scanning the QR code in Webtop or Nextcloud, i received a code for Validation. Here i received nothing.