Multifactor authentication: Difference between revisions

<translate>

Multifactor authentication (MFA) allows you to protect your account with more than a password. Once your account is enrolled in multifactor authentication, you will be prompted for a second action in addition to your password. This action could be accepting a notification on your phone (Duo Push), entering a 6-digit time-based code, entering a single-use bypass code, or pushing the button on a YubiKey hardware key. This second factor will be required when connecting to many of our services. Note that while we are deploying this, not all of our services may support it, but our goal is to protect most of our services with multifactor authentication in the near future.  

=== Registering multiple factors ===

When you enable multifactor authentication for your account, we <b>strongly recommend</b> that you configure at least two options of second factor. For example, you can use a phone and single-use codes, a phone and a hardware key, or two hardware keys. This will ensure that if you lose one factor, you can still use your other one to access your account.

When using a smart phone or tablet, you will first need to install the Duo Mobile authentication app. You can find it on the [https://itunes.apple.com/us/app/duo-mobile/id422663827 Apple Store], or on [https://play.google.com/store/apps/details?id=com.duosecurity.duomobile Google Play]. Once the application is installed, visit the [https://ccdb.computecanada.ca/multi_factor_authentications multifactor authentication management page in your account]. On that page, select the Duo Mobile option, give a name to your device, then scan the QR code that is shown to you.

YubiKeys are hardware tokens made by the company [https://yubico.com/ Yubico]. They have the size of a small USB stick, and different models support different ports. Some will connect to a USB-A port, USB-C port, Lightning. Some models also support near field communication (NFC) to be used with your phone or tablet. To figure out which one may best suit your need, consult [https://www.yubico.com/quiz/ this page]. They cost between 50$ and 100$, and they are the best option if you do not want to use or if you do not have a smart phone. They are also the best option if you are often in situations when using your phone is not possible.  

YubiKeys support multiple authentication protocols which are commonly used for web authentication, such as WebAuthn, FIDO2, U2F. However, the one protocol which works with SSH connections used on our clusters is called Yubico One Time Password (OTP). When using Yubico OTP, pressing the button on the key will write a long string of characters looking like <tt>vvcccbhbndkglanfhevnricjdvftcfugdtjeflgrhenr</tt>, which will act as your second factor.  

Yubico OTP itself has two modes which it can use. In Yubico Cloud mode, authentication requests are forwarded to the Yubico Cloud, where your key was preregistered when you purchased it. This mode is not supported by Duo, which instead supports Yubico OTP. For this mode, you need to have the Public ID, the Private ID, and the Secret Key for your key. If you already have this information, you can use your existing information to register your Yubico OTP on your [https://ccdb.computecanada.ca/multi_factor_authentications multifactor authentication account page]. If you do not have this information, you need to configure your key using the steps below.  

To configure your YubiKey, follow these instructions:  

# Download and install the YubiKey Manager software from the [https://www.yubico.com/support/download/yubikey-manager/ Yubico website].

# Insert your YubiKey and launch the YubiKey Manager software.

</gallery>

=== When connecting via SSH ===  

When your account has multifactor authentication enabled, if you connect to a cluster which supports it via SSH, you will be prompted to use your second factor after you first authenticate either using your password or your [[SSH Keys|SSH key]]. This prompt will look like this:  

|result= Duo two-factor login for name

Enter a passcode or select one of the following options:

Passcode or option (1-1):}}

At this point, you can either select which phone or tablet (if you have multiple devices enrolled, you would get a list) you want Duo to send a notification to. You will then get a notification on your device, which you need to accept or decline.  

If you are using a YubiKey, a backup code, or if you prefer to enter the time-based one-time password that the Duo Mobile application shows, you would write these instead of selecting an option. For example:  

{{Command|ssh cluster.computecanada.ca

|result= Duo two-factor login for name

Enter a passcode or select one of the following options:

Passcode or option (1-1):vvcccbhbllnuuebegkkbcfdftndjijlneejilrgiguki

Success. Logging you in...}}

You can configure your OpenSSH client to only ask for the second factor every so often by using the "ControlMaster" mechanism. To do so, edit your <tt>.ssh/config</tt> to add the lines:

<pre>

where you would replace <tt>HOSTNAME</tt> with the host name of the server for which you want this configuration.

Once multifactor authentication is enabled on your account, you will be required to use it when connecting to our account portal. After using your username and password, you will see a prompt similar to this:

<gallery widths=300px heights=300px>

at this point, select the option you want to use.

=== I do not have a smart phone or tablet, or they are too old. Can I still use multifactor authentication? ===

Yes. In this case, you need to use YubiKeys (see above).

* If you have backup codes, or if you have more than one device, use that other mechanism to connect to your account on our [https://ccdb.computecanada.ca/multi_factor_authentications account portal], and then delete your lost device. Then, register a new device.  

* If you do not have backup codes, or if have lost all of your devices, contact our [[Technical support]] for assistance.

</translate>