Registration/2FA: Difference between revisions
(Created page with "= Generate a Second Factor = To improve security a '''2-factor authentication mechanism (2FA)''' is being enforced for logins to bwUniCluster/bwForClusters. In addition to th...") |
m (→How 2FA works) |
||
| Line 6: | Line 6: | ||
On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent '''One-Time Passwords''' (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a '''Hardware Token''') or of a normal application running on a common device (a '''Software Token'''). |
On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent '''One-Time Passwords''' (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a '''Hardware Token''') or of a normal application running on a common device (a '''Software Token'''). |
||
| ⚫ | |||
The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password. |
The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password. |
||
| ⚫ | |||
[https://www.yubico.com/resources/glossary/yubico-otp/ Yubico OTP] also supported if you want to use your Yubikey without depending on having a six-digit code displayed. But you can also use the Yubikey as a generator for six-digit [https://www.yubico.com/resources/glossary/oath-totp/ TOTP]. |
|||
'''It is very important that the device that generates the One-Time Passwords and the device which is used to log into bwUniCluster 2.0 are not the same.''' Otherwise an attacker who gains access to your system can steal both the service password and the secret key of the Software Token application, which allows them to generate One-Time Passwords and log into the HPC system without your knowledge. |
'''It is very important that the device that generates the One-Time Passwords and the device which is used to log into bwUniCluster 2.0 are not the same.''' Otherwise an attacker who gains access to your system can steal both the service password and the secret key of the Software Token application, which allows them to generate One-Time Passwords and log into the HPC system without your knowledge. |
||
{| |
|||
The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps: |
| The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps: |
||
Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS] |
|||
* Microsoft Authenticator for [https://www.microsoft.com/de-de/security/mobile-authenticator-app Android or iOS] |
* Microsoft Authenticator for [https://www.microsoft.com/de-de/security/mobile-authenticator-app Android or iOS] |
||
* LastPass Authenticator for [https://lastpass.com/auth/ Android, iOS or Windows] |
* LastPass Authenticator for [https://lastpass.com/auth/ Android, iOS or Windows] |
||
| ⚫ | |||
* Aegis Authenticator for [https://getaegis.app/ Android incl. F-Droid] |
* Aegis Authenticator for [https://getaegis.app/ Android incl. F-Droid] |
||
* andOTP Authenticator for [https://github.com/andOTP/andOTP Android incl. F-Droid] |
* andOTP Authenticator for [https://github.com/andOTP/andOTP Android incl. F-Droid] |
||
* OTP Auth for [https://apps.apple.com/app/otp-auth/id659877384 iOS] |
* OTP Auth for [https://apps.apple.com/app/otp-auth/id659877384 iOS] |
||
| ⚫ | |||
* (On Linux you can use KeepassXC or otpclient) |
|||
These are only suggestions. You can use any application compatible with the [https://tools.ietf.org/html/rfc6238 TOTP] standard. |
These are only suggestions. You can use any application compatible with the [https://tools.ietf.org/html/rfc6238 TOTP] standard. |
||
| ⚫ | |||
|} |
|||
| ⚫ | |||
= Token Management = |
= Token Management = |
||
Revision as of 15:04, 18 January 2022
Generate a Second Factor
To improve security a 2-factor authentication mechanism (2FA) is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the second factor, has to be entered on every login.
How 2FA works
On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent One-Time Passwords (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a Hardware Token) or of a normal application running on a common device (a Software Token).
The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password.
Yubico OTP also supported if you want to use your Yubikey without depending on having a six-digit code displayed. But you can also use the Yubikey as a generator for six-digit TOTP.
It is very important that the device that generates the One-Time Passwords and the device which is used to log into bwUniCluster 2.0 are not the same. Otherwise an attacker who gains access to your system can steal both the service password and the secret key of the Software Token application, which allows them to generate One-Time Passwords and log into the HPC system without your knowledge.
| The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:
Google Authenticator for Android or iOS
These are only suggestions. You can use any application compatible with the TOTP standard. |
 |
Token Management
bwUniCluster 2.0 Tokens are generally managed via the My Tokens menu entry on the central bwIDM system. Here you can register, activate, deactivate and delete Tokens.
KIT users can also re-use their existing hardware and software tokens for the HPC systems.
Registering a new Software or Hardware Token
1. Registering a new Token starts with a click on New smartphone token. If you happen to own a USB Hardware Token device made by the manufacturer Yubikey, you can click on New Yubikey Token instead.
2. A new windows opens. Click on Start to generate a new QR code. This may take a while.
NOTE: The QR code contains a key which has to remain secret. Only use the QR code to link your Software Token app with bwIDM in the next step. Do not save the QR code, print it out or share it with someone else. You can always generate more codes later.
3. Start the Software Token app on your separate device and scan the QR code. The exact process is a little bit different in every app, but is usually started by pressing on a Button with a Plus (+) sign or an icon of a QR code.
4. Once the QR code has been loaded into your Software Token app there should be a new entry called bwIDM. Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item. You will receive a six-digit code. Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click on Check.
5. If everything worked as expected, you will be returned to the My Tokens screen and there will be a new entry for your Software Token:
6. Repeat the process to register additional tokens. Please register at least a Backup TAN list in addition to the hardware/software token you plan to use regularly. If you only register a single token and happen to lose access to it, e.g. because you lose your device, uninstall the software token application or data gets deleted/corrupted, you will neither be able to log into the cluster system nor register a new token. The support channels are able to deactivate your lost token, but this process will take its time.
Deactivating a Token
Click on the Disable button next to the Token entry on the My Tokens screen.
Deleting a Token
After a Token has been disabled a new button labeled Delete will appear. Click on it to delete the Token.