cc_staff
127
edits
Multifactor authentication: Difference between revisions
Jump to navigation
Jump to search
m
Fix typo
No edit summary |
m (Fix typo) |
||
| Line 1: | Line 1: | ||
{{Draft}} | {{Draft}} | ||
Multifactor authentication (MFA) allows you to protect your account with more than a password. Once your account is enrolled in multifactor authentication, you will be prompted for a second action in addition to your password. This action could be accepting a notification on your phone (Duo Push), entering a 6-digit time-based code, entering a single-use bypass code, or pushing the button on a YubiKey hardware key. This second factor will be required when connecting to many of our services. Note that while we are deploying this, not all of our services may support it, but our goal is to protect most of our services with | Multifactor authentication (MFA) allows you to protect your account with more than a password. Once your account is enrolled in multifactor authentication, you will be prompted for a second action in addition to your password. This action could be accepting a notification on your phone (Duo Push), entering a 6-digit time-based code, entering a single-use bypass code, or pushing the button on a YubiKey hardware key. This second factor will be required when connecting to many of our services. Note that while we are deploying this, not all of our services may support it, but our goal is to protect most of our services with multifactor authentication in the near future. | ||
== Registering factors == | == Registering factors == | ||
=== Registering multiple factors === | === Registering multiple factors === | ||
When you enable | When you enable multifactor authentication for your account, we <b>strongly recommend</b> that you configure at least two options of second factor. For example, you can use a phone and single-use codes, a phone and a hardware key, or two hardware keys. This will ensure that if you lose one factor, you can still use your other one to access your account. | ||
=== Using a smart phone or tablet === | === Using a smart phone or tablet === | ||
| Line 15: | Line 15: | ||
YubiKeys support multiple authentication protocols which are commonly used for web authentication, such as WebAuthn, FIDO2, U2F. However, the one protocol which works with SSH connections used on our clusters is called Yubico One Time Password (OTP). When using Yubico OTP, pressing the button on the key will write a long string of characters looking like <tt>vvcccbhbndkglanfhevnricjdvftcfugdtjeflgrhenr</tt>, which will act as your second factor. | YubiKeys support multiple authentication protocols which are commonly used for web authentication, such as WebAuthn, FIDO2, U2F. However, the one protocol which works with SSH connections used on our clusters is called Yubico One Time Password (OTP). When using Yubico OTP, pressing the button on the key will write a long string of characters looking like <tt>vvcccbhbndkglanfhevnricjdvftcfugdtjeflgrhenr</tt>, which will act as your second factor. | ||
Yubico OTP itself has two modes which it can use. In Yubico Cloud mode, authentication requests are forwarded to Yubico's cloud, in which your key is already preregistered when you purchase it. This mode is not supported by Duo, which instead supports Yubico OTP. For this mode, you need to have the Public ID, the Private ID, and the Secret Key for your key. If you already have this information, you can use your existing information to register your Yubico OTP on your [https://ccdb.computecanada.ca/multi_factor_authentications | Yubico OTP itself has two modes which it can use. In Yubico Cloud mode, authentication requests are forwarded to Yubico's cloud, in which your key is already preregistered when you purchase it. This mode is not supported by Duo, which instead supports Yubico OTP. For this mode, you need to have the Public ID, the Private ID, and the Secret Key for your key. If you already have this information, you can use your existing information to register your Yubico OTP on your [https://ccdb.computecanada.ca/multi_factor_authentications multifactor authentication account page]. If you do not have this information, you need to configure your key using the steps below. | ||
==== Configuring your YubiKey for Yubico OTP ==== | ==== Configuring your YubiKey for Yubico OTP ==== | ||
| Line 26: | Line 26: | ||
# Select <tt>Yubico OTP</tt> | # Select <tt>Yubico OTP</tt> | ||
# Select <tt>Use serial</tt>, then generate a Private ID and a Secret Key. '''Securely save a copy of the data in the Public ID, Private ID, and Secret key fields before you click Finish, as you will need the data for the next step.''' | # Select <tt>Use serial</tt>, then generate a Private ID and a Secret Key. '''Securely save a copy of the data in the Public ID, Private ID, and Secret key fields before you click Finish, as you will need the data for the next step.''' | ||
# Keep the previous screen open and log into the CCDB to register your YubiKey in your [https://ccdb.computecanada.ca/multi_factor_authentications | # Keep the previous screen open and log into the CCDB to register your YubiKey in your [https://ccdb.computecanada.ca/multi_factor_authentications multifactor authentication account page]. | ||
<gallery widths=300px heights=300px> | <gallery widths=300px heights=300px> | ||
File:Yubico Manager OTP.png|Step 3 | File:Yubico Manager OTP.png|Step 3 | ||