Multifactor authentication

Multifactor authentication (MFA) allows you to protect your account with more than a password. Once your account is configured to use this feature, you will need to enter your username and password as usual, and then perform a second action (the second factor) to access our services.

Factors for this second authentication step currently are:

• approving a notification on a smart device through the Duo Mobile application;
• entering a code generated on demand;
• pushing a button on a hardware key (YubiKey).

Registering factors

Registering multiple factors

When you enable multifactor authentication for your account, we strongly recommend that you configure at least two options of second factor. For example, you can use a phone and single-use codes, a phone and a hardware key, or two hardware keys. This will ensure that if you lose one factor, you can still use your other one to access your account.
This feature will be progressively deployed; however, some of our services may not support it.

To use a smart phone or tablet

When using a smart phone or tablet, you will first need to install the Duo Mobile authentication app. You can find it on the Apple Store, or on Google Play. Once the application is installed, visit the multifactor authentication management page in your account. On that page, select the Duo Mobile option, give a name to your device, then scan the QR code that is shown to you.

Using a YubiKey hardware key

YubiKeys are hardware tokens made by the company Yubico. They have the size of a small USB stick, and different models support different ports. Some will connect to a USB-A port, USB-C port, Lightning. Some models also support near field communication (NFC) to be used with your phone or tablet. To figure out which one may best suit your need, consult this page. They cost between 50$ and 100$, and they are the best option if you do not want to use or if you do not have a smart phone. They are also the best option if you are often in situations when using your phone is not possible.

YubiKeys support multiple authentication protocols which are commonly used for web authentication, such as WebAuthn, FIDO2, U2F. However, the one protocol which works with SSH connections used on our clusters is called Yubico One Time Password (OTP). When using Yubico OTP, pressing the button on the key will write a long string of characters looking like vvcccbhbndkglanfhevnricjdvftcfugdtjeflgrhenr, which will act as your second factor.

Yubico OTP itself has two modes which it can use. In Yubico Cloud mode, authentication requests are forwarded to the Yubico Cloud, where your key was preregistered when you purchased it. This mode is not supported by Duo, which instead supports Yubico OTP. For this mode, you need to have the Public ID, the Private ID, and the Secret Key for your key. If you already have this information, you can use your existing information to register your Yubico OTP on your multifactor authentication account page. If you do not have this information, you need to configure your key using the steps below.

Configuring your YubiKey for Yubico OTP

To configure your YubiKey, follow these instructions:

1. Download and install the YubiKey Manager software from the Yubico website.
2. Insert your YubiKey and launch the YubiKey Manager software.
3. In the YubiKey Manager software, select Applications, then OTP
4. Select Configure for either slot 1 or slot 2. Slot 1 corresponds to a short touch, while slot 2 is a long touch on the key. Slot 1 is typically pre-registered for Yubico Cloud mode. If you are already using this slot for other services, either use slot 2, or click on Swap to transfer the configuration to slot 2.
5. Select Yubico OTP
6. Select Use serial, then generate a Private ID and a Secret Key. Securely save a copy of the data in the Public ID, Private ID, and Secret key fields before you click Finish, as you will need the data for the next step.
7. Keep the previous screen open and log into the CCDB to register your YubiKey in your multifactor authentication account page.

• 

  Step 3

• 

  Step 4

• 

  Step 5

• 

  Step 6

• 

  Step 7

Using your second factor

When connecting via SSH

When your account has multifactor authentication enabled, if you connect to a cluster which supports it via SSH, you will be prompted to use your second factor after you first authenticate either using your password or your SSH key. This prompt will look like this:

[name@server ~]$ ssh cluster.computecanada.ca
Duo two-factor login for name

Enter a passcode or select one of the following options:

 1. Duo Push to My phone (iOS)

Passcode or option (1-1):

At this point, you can either select which phone or tablet (if you have multiple devices enrolled, you would get a list) you want Duo to send a notification to. You will then get a notification on your device, which you need to accept or decline.

If you are using a YubiKey, a backup code, or if you prefer to enter the time-based one-time password that the Duo Mobile application shows, you would write these instead of selecting an option. For example:

[name@server ~]$ ssh cluster.computecanada.ca
Duo two-factor login for name

Enter a passcode or select one of the following options:

 1. Duo Push to My phone (iOS)

Passcode or option (1-1):vvcccbhbllnuuebegkkbcfdftndjijlneejilrgiguki
Success. Logging you in...

Configuring your SSH client to only ask every so often

You can configure your OpenSSH client to only ask for the second factor every so often by using the "ControlMaster" mechanism. To do so, edit your .ssh/config to add the lines:

Host HOSTNAME
    ControlPath ~/.ssh/cm-%r@%h:%p
    ControlMaster auto
    ControlPersist 10m

where you would replace HOSTNAME with the host name of the server for which you want this configuration.

When authenticating to our account portal

Once multifactor authentication is enabled on your account, you will be required to use it when connecting to our account portal. After using your username and password, you will see a prompt similar to this:

• 

at this point, select the option you want to use.

Frequently asked questions

I do not have a smart phone or tablet, or they are too old. Can I still use multifactor authentication?

Yes. In this case, you need to use YubiKeys (see above).

I have lost my second factor device. What can I do?

• If you have backup codes, or if you have more than one device, use that other mechanism to connect to your account on our account portal, and then delete your lost device. Then, register a new device.
• If you do not have backup codes, or if have lost all of your devices, contact our Technical support for assistance.

Compute Canada Data Base