Difference between revisions of "Registration/2FA"

From bwHPC Wiki
Jump to: navigation, search
m
m
(20 intermediate revisions by 2 users not shown)
Line 2: Line 2:
   
 
To improve security a '''2-factor authentication mechanism (2FA)''' is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the '''second factor''', has to be entered on every login.
 
To improve security a '''2-factor authentication mechanism (2FA)''' is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the '''second factor''', has to be entered on every login.
  +
   
 
== How 2FA works ==
 
== How 2FA works ==
Line 13: Line 14:
 
|}
 
|}
   
  +
[[File:2fa token code.jpg|right|200px|thumb|Hardware Token for TOTP]]
{| style="width: 100%;"
 
| On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent '''one-time passwords''' (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a '''hardware token''') or of a normal application running on a common device (a '''software token''').
+
On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent '''one-time passwords''' (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a '''hardware token''') or of a normal application running on a common device (a '''software token''').
   
 
The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values (TOTPs) which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password.
 
The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values (TOTPs) which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password.
Line 20: Line 21:
 
Typically a new TOTP value is generated every 30 seconds. When the current TOTP value has once been used successfully for a login, it is depleted and one has to wait up to 30 seconds for the next TOTP value.
 
Typically a new TOTP value is generated every 30 seconds. When the current TOTP value has once been used successfully for a login, it is depleted and one has to wait up to 30 seconds for the next TOTP value.
   
  +
| [[File:2fa token code.jpg|center|200px|thumb|Hardware Token for TOTP]]
 
  +
[[File:Otpapp.png|right|150px|thumb|Source: https://getaegis.app]]
|}
 
  +
{| style="width: 100%;"
 
| The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:
+
The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:
 
* Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS]
 
* Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS]
 
* Microsoft Authenticator for [https://play.google.com/store/apps/details?id=com.azure.authenticator Android] or [https://apps.apple.com/de/app/microsoft-authenticator/id983156458 iOS] ([https://www.microsoft.com/de-de/security/mobile-authenticator-app Web Page])
 
* Microsoft Authenticator for [https://play.google.com/store/apps/details?id=com.azure.authenticator Android] or [https://apps.apple.com/de/app/microsoft-authenticator/id983156458 iOS] ([https://www.microsoft.com/de-de/security/mobile-authenticator-app Web Page])
 
* LastPass Authenticator for [https://play.google.com/store/apps/details?id=com.lastpass.authenticator Android], [https://apps.apple.com/us/app/lastpass-authenticator/id1079110004 iOS] or [https://lastpass.com/auth/ Windows]
 
* LastPass Authenticator for [https://play.google.com/store/apps/details?id=com.lastpass.authenticator Android], [https://apps.apple.com/us/app/lastpass-authenticator/id1079110004 iOS] or [https://lastpass.com/auth/ Windows]
 
* Aegis Authenticator for [https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis Android (Google Play)] or [https://f-droid.org/en/packages/com.beemdevelopment.aegis/ Android (F-Droid)] ([https://getaegis.app/ Web Page])
 
* Aegis Authenticator for [https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis Android (Google Play)] or [https://f-droid.org/en/packages/com.beemdevelopment.aegis/ Android (F-Droid)] ([https://getaegis.app/ Web Page])
* andOTP Authenticator for [https://play.google.com/store/apps/details?id=org.shadowice.flocke.andotp Android (Google Play] or [https://f-droid.org/packages/org.shadowice.flocke.andotp/ Android (F-Droid)] ([https://github.com/andOTP/andOTP GitHub])
+
* andOTP Authenticator for [https://play.google.com/store/apps/details?id=org.shadowice.flocke.andotp Android (Google Play)] or [https://f-droid.org/packages/org.shadowice.flocke.andotp/ Android (F-Droid)] ([https://github.com/andOTP/andOTP GitHub])
 
* OTP Auth for [https://apps.apple.com/app/otp-auth/id659877384 iOS]
 
* OTP Auth for [https://apps.apple.com/app/otp-auth/id659877384 iOS]
 
* (Authy for [https://play.google.com/store/apps/details?id=com.authy.authy Android], [https://apps.apple.com/us/app/authy/id494168017 iOS], [https://authy.com/download/ Mac, Windows or Linux]) requires account
 
* (Authy for [https://play.google.com/store/apps/details?id=com.authy.authy Android], [https://apps.apple.com/us/app/authy/id494168017 iOS], [https://authy.com/download/ Mac, Windows or Linux]) requires account
Line 37: Line 38:
 
If you don't want to use a smartphone, we recommend using a hardware token, such as Yubikey or another TOTP-compatible device. [https://www.yubico.com/resources/glossary/yubico-otp/ Yubico OTP] is also supported if you want to use your Yubikey without depending on having a six-digit code displayed. But you can also use the Yubikey as a generator for six-digit [https://www.yubico.com/resources/glossary/oath-totp/ TOTP].
 
If you don't want to use a smartphone, we recommend using a hardware token, such as Yubikey or another TOTP-compatible device. [https://www.yubico.com/resources/glossary/yubico-otp/ Yubico OTP] is also supported if you want to use your Yubikey without depending on having a six-digit code displayed. But you can also use the Yubikey as a generator for six-digit [https://www.yubico.com/resources/glossary/oath-totp/ TOTP].
   
| [[File:Otpapp.png|center|150px|thumb|Source: https://getaegis.app]]
 
|}
 
   
 
= Token Management =
 
= Token Management =
Line 49: Line 48:
 
* If you lose access to all your tokens, you will not be able to create new tokens and support will have to reset your tokens manually.
 
* If you lose access to all your tokens, you will not be able to create new tokens and support will have to reset your tokens manually.
 
* The "backup TAN list" should always be created and printed in a '''second step'''. The printout should be kept in a separate place for emergencies.
 
* The "backup TAN list" should always be created and printed in a '''second step'''. The printout should be kept in a separate place for emergencies.
* Please disable all privacy tools and ad blockers when registering new tokens. These tools prevent the registration website from generating new security tokens.
 
 
* Please clean up your second factors as soon as you have created new tokens. Tokens that can no longer be used (e.g. because not initialized, smartphone/Yubikey lost, etc.) or an old backup TAN list where you have already used all TANs or there is no printout should be deactivated and deleted.
 
* Please clean up your second factors as soon as you have created new tokens. Tokens that can no longer be used (e.g. because not initialized, smartphone/Yubikey lost, etc.) or an old backup TAN list where you have already used all TANs or there is no printout should be deactivated and deleted.
  +
* Returning users who have already activated one or more tokens must first verify their token before they can create new tokens, see section [[Registration/2FA#Returning_Users|Returning Users]].
  +
* '''Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.''' These tools prevent the registration website from generating new security tokens. When the problems remains (you can not generate the QR code or can not confirm it by clicking CHECK), please try once more with an entirely new unmodified web browser profile.
 
|}
 
|}
   
'''bwUniCluster/bwForCluster Tokens''' are generally managed via the '''Index -> My Tokens''' menu entry on the registration pages for the clusters. Here you can register, activate, deactivate and delete Tokens. To activate the second factor, '''please follow these 4 simple steps:'''
+
'''bwUniCluster/bwForCluster Tokens''' are generally managed via the '''Index -> My Tokens''' menu entry on the registration pages for the clusters. Here you can register, activate, deactivate and delete tokens.
   
  +
To activate the second factor, '''please perform the following steps:'''
1. '''Select the cluster''' for which you want to create a second factor:</br> &rarr; [https://login.bwidm.de/user/twofa.xhtml '''bwUniCluster 2.0''' and '''bwForCluster JUSTUS 2'''] (KIT users can also reuse their existing hardware and software tokens for the HPC systems.)</br> &rarr; [https://bwservices.uni-heidelberg.de//user/twofa.xhtml '''bwForCluster MLS&WISO''']
 
  +
  +
1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> &rarr; [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 2.0''' and '''bwForCluster JUSTUS 2'''] (2FA tokens are valid for both clusters; KIT members can reuse their existing hardware and software tokens)</br> &rarr; [https://bwservices.uni-heidelberg.de//user/twofa.xhtml Registration server for '''bwForCluster MLS&WISO''']
 
[[File:BwIDM-twofa.png|center|600px|thumb|My Tokens]]
 
[[File:BwIDM-twofa.png|center|600px|thumb|My Tokens]]
   
2. '''Create a new "[[Registration/2FA#Registering_a_new_Software_Token_using_a_Mobile_APP|Smartphone]]" or "[[Registration/2FA#Yubikey_OTP|Yubikey Token]]"'''.
+
2. '''Register a new "[[Registration/2FA#Registering_a_new_Software_Token_using_a_Mobile_APP|Smartphone Token]]"''' or if you own a [https://www.yubico.com/ Yubikey]''' register a new "[[Registration/2FA#Registering_a_new_Yubikey_OTP_Token|Yubikey Token]]"''' or '''"[[Registration/2FA#Registering_a_new_Yubikey_OATH_TOTP_Token|Yubikey OATH TOTP Token]]"'''.
   
3. '''Create a new "[[Registration/2FA#Backup_TAN_List|TAN List]]" (backup TAN list)'''.
+
3. '''Register a new "[[Registration/2FA#Backup_TAN_List|TAN List]]" (backup TAN list)'''.
   
 
4. Repeat step 2. for additional tokens.
 
4. Repeat step 2. for additional tokens.
  +
   
 
== Registering a new Software Token using a Mobile APP ==
 
== Registering a new Software Token using a Mobile APP ==
   
  +
{|style="background:#deffee; width:100%;"
1. Registering a new Token starts with a click '''NEW SMARTPHONE TOKEN'''.
 
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
[[Image:Attention.svg|center|25px]]
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.
  +
|}
  +
  +
1. Select the [[Registration/2FA#Token_Management|registration server]] of the cluster for which you want to create a second factor and login to it.
  +
  +
2. Registering a new Token starts with a click '''NEW SMARTPHONE TOKEN'''.
 
[[File:BwIDM-token.png|center|600px|thumb|Create a new Token]]
 
[[File:BwIDM-token.png|center|600px|thumb|Create a new Token]]
   
2. A new window opens. Click '''Start''' to generate a new '''QR code'''.
+
3. A new window opens. Click '''Start''' to generate a new '''QR code'''.
 
This may take a while.
 
This may take a while.
 
{|style="background:#deffee; width:100%;"
 
{|style="background:#deffee; width:100%;"
Line 81: Line 93:
 
[[File:BwIDM-qr.png|center|600px|thumb|QR Code for Mobile App]]
 
[[File:BwIDM-qr.png|center|600px|thumb|QR Code for Mobile App]]
   
3. Start the software token app on your separate device and scan the QR code.
+
4. Start the software token app on your separate device and scan the QR code.
 
The exact process is a little bit different in every app, but is usually started by pressing on a button with a plus (+) sign or an icon of a QR code.
 
The exact process is a little bit different in every app, but is usually started by pressing on a button with a plus (+) sign or an icon of a QR code.
   
4. Once the QR code has been loaded into your Software Token app there should be a new entry called '''bwIDM''' or '''bwServices''' (MLS&WISO).
+
5. Once the QR code has been loaded into your Software Token app there should be a new entry called '''bwIDM''' (bwUniCluster and JUSTUS 2) or '''bwServices''' (MLS&WISO).
 
Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item.
 
Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item.
 
You will receive a six-digit code.
 
You will receive a six-digit code.
Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click '''Check'''.
+
Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click '''CHECK'''.
  +
{|style="background:#deffee; width:100%;"
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
[[Image:Attention.svg|center|25px]]
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
If you do not confirm the token by entering the six-digit code in the "Current code:" field, the token will '''NOT''' be initialized!
  +
|}
   
5. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your software token.
+
6. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your software token.
 
[[File:BwIDM-app.png|center|400px|thumb|Success]]
 
[[File:BwIDM-app.png|center|400px|thumb|Success]]
   
6. Repeat the process to register additional tokens.
+
7. Repeat the process to register additional tokens.
 
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
 
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
   
  +
=== Registering a Yubikey OATH TOTP ===
 
  +
== Registering a new Yubikey OTP Token ==
  +
  +
{|style="background:#deffee; width:100%;"
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
[[Image:Attention.svg|center|25px]]
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.
  +
|}
  +
  +
[https://developers.yubico.com/OTP/OTPs_Explained.html Yubikey OTP] is even easier and you don't need a device that displays the six-digit code or extra software.
  +
New Yubikeys are already configured to provide Yubikey OTP in slot 1.
  +
If you need to configure your Yubikey, read this [[Registration/2FA/Yubikey|documentation]].
  +
  +
1. Select the [[Registration/2FA#Token_Management|registration server]] of the cluster for which you want to create a second factor and login to it.
  +
  +
2. If you want to use [https://www.yubico.com/resources/glossary/yubico-otp/ Yubico OTP], you can click '''NEW YUBIKEY TOKEN''' instead.
  +
[[File:BwIDM-token.png|center|600px|thumb|Generate Yubikey OTP]]
  +
  +
3. Yubikey OTP is configured to slot 1 on new Yubikeys, so you only need to click in the text box and then touch the metal part of your Yubikey.
  +
Please refer to this [[Registration/2FA/Yubikey|documentation]] on how to configure your Yubikey.
  +
[[File:BwIDM-yubikey.png|center|400px|thumb|Yubikey OTP]]
  +
  +
4. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your Yubikey.
  +
[[File:BwIDM-yubikey2.png|center|400px|thumb|Success]]
  +
  +
5. Repeat the process to register additional tokens.
  +
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
  +
  +
  +
== Registering a new Yubikey OATH TOTP Token ==
  +
  +
{|style="background:#deffee; width:100%;"
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
[[Image:Attention.svg|center|25px]]
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.
  +
|}
   
 
[https://developers.yubico.com/OATH/ Yubikey OATH TOTP] generates the TANs on your Yubikey and therefore you can use different computers and Android phones to generate these codes.
 
[https://developers.yubico.com/OATH/ Yubikey OATH TOTP] generates the TANs on your Yubikey and therefore you can use different computers and Android phones to generate these codes.
Line 102: Line 157:
 
"Yubikey OTP" (not "Yubikey OATH TOTP") is even easier and you don't need a device that displays the six-digit code or extra software (go to step [[Registration/2FA#Yubikey_OTP|Yubikey OTP]]).
 
"Yubikey OTP" (not "Yubikey OATH TOTP") is even easier and you don't need a device that displays the six-digit code or extra software (go to step [[Registration/2FA#Yubikey_OTP|Yubikey OTP]]).
   
  +
1. Select the [[Registration/2FA#Token_Management|registration server]] of the cluster for which you want to create a second factor and login to it.
1. Registering a new Token starts with a click '''NEW SMARTPHONE TOKEN'''.
 
  +
  +
2. Registering a new Token starts with a click '''NEW SMARTPHONE TOKEN'''.
 
[[File:BwIDM-token.png|center|600px|thumb|Create a new Token]]
 
[[File:BwIDM-token.png|center|600px|thumb|Create a new Token]]
   
2. A new window opens. Click '''Start''' to generate a new '''QR code'''.
+
3. A new window opens. Click '''Start''' to generate a new '''QR code'''.
 
This may take a while.
 
This may take a while.
 
{|style="background:#deffee; width:100%;"
 
{|style="background:#deffee; width:100%;"
Line 116: Line 173:
 
|}
 
|}
   
3. Start the Yubico Authenticator on your OS, click the three vertical dots in the upper right corner and select '''Scan QR code'''.
+
4. Start the Yubico Authenticator on your OS, click the three vertical dots in the upper right corner and select '''Scan QR code'''.
 
[[File:BwIDM-yubi1.png|center|600px|thumb|QR Code and Yubico Authenticator on Linux]]
 
[[File:BwIDM-yubi1.png|center|600px|thumb|QR Code and Yubico Authenticator on Linux]]
   
4. Yubico Authenticator automatically translates the QR code to a new entry called '''bwIDM''' or '''bwServices''' (MLS&WISO).
+
5. Yubico Authenticator automatically translates the QR code to a new entry called '''bwIDM''' or '''bwServices''' (MLS&WISO).
 
Click '''Add account'''.
 
Click '''Add account'''.
 
[[File:BwIDM-yubi2.png|center|600px|thumb|Create new TOTP on Yubico Authenticator]]
 
[[File:BwIDM-yubi2.png|center|600px|thumb|Create new TOTP on Yubico Authenticator]]
   
5. You will receive a six-digit code.
+
6. You will receive a six-digit code.
 
Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click '''CHECK'''.
 
Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click '''CHECK'''.
 
[[File:BwIDM-yubi3.png|center|600px|thumb|Verify TOTP]]
 
[[File:BwIDM-yubi3.png|center|600px|thumb|Verify TOTP]]
   
6. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your software token.
+
7. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your software token.
 
[[File:BwIDM-app.png|center|400px|thumb|Success]]
 
[[File:BwIDM-app.png|center|400px|thumb|Success]]
   
7. Repeat the process to register additional tokens.
+
8. Repeat the process to register additional tokens.
 
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
 
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
   
== Yubikey OTP ==
 
 
[https://developers.yubico.com/OTP/OTPs_Explained.html Yubikey OTP] is even easier and you don't need a device that displays the six-digit code or extra software.
 
New Yubikeys are already configured to provide Yubikey OTP in slot 1.
 
If you need to configure your Yubikey, read this [[Registration/2FA/Yubikey|documentation]].
 
 
1. If you want to use [https://www.yubico.com/resources/glossary/yubico-otp/ Yubico OTP], you can click '''NEW YUBIKEY TOKEN''' instead.
 
[[File:BwIDM-token.png|center|600px|thumb|Generate Yubikey OTP]]
 
 
2. Yubikey OTP is configured to slot 1 on new Yubikeys, so you only need to click in the text box and then touch the metal part of your Yubikey.
 
Please refer to this [[Registration/2FA/Yubikey|documentation]] on how to configure your Yubikey.
 
[[File:BwIDM-yubikey.png|center|400px|thumb|Yubikey OTP]]
 
 
3. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your Yubikey.
 
[[File:BwIDM-yubikey2.png|center|400px|thumb|Success]]
 
 
4. Repeat the process to register additional tokens.
 
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
 
   
 
== Backup TAN List ==
 
== Backup TAN List ==
Line 161: Line 200:
 
Please do not use the Backup TANs for regular cluster login, because you have only a limited number of TANs.
 
Please do not use the Backup TANs for regular cluster login, because you have only a limited number of TANs.
 
Each TAN can only be used once.
 
Each TAN can only be used once.
  +
Please disable all privacy tools, ad blockers and further add-ons when registering a new Backup TAN list.
 
|}
 
|}
   
  +
1. Select the [[Registration/2FA#Token_Management|registration server]] of the cluster for which you want to create a second factor and login to it.
1. Please create at least one "Backup TAN list" by clicking '''CREATE NEW TAN LIST'''.
 
  +
  +
2. Please create at least one "Backup TAN list" by clicking '''CREATE NEW TAN LIST'''.
 
[[File:BwIDM-token.png|center|600px|thumb|Generate Backup TAN list]]
 
[[File:BwIDM-token.png|center|600px|thumb|Generate Backup TAN list]]
   
2. Click '''START'''. You will be redirected to the '''My Tokens''' screen and there will be a new entry for your backup TANs.
+
3. Click '''START'''. You will be redirected to the '''My Tokens''' screen and there will be a new entry for your backup TANs.
 
[[File:BwIDM-tan.png|center|400px|thumb|Success]]
 
[[File:BwIDM-tan.png|center|400px|thumb|Success]]
   
3. Click '''SHOW TANS''', print the codes and keep then in a separate place for emergencies.
+
4. Click '''SHOW TANS''', print the codes and keep then in a separate place for emergencies.
 
[[File:JUSTUS-2-2FA-backup-TAN-list.png|center|800px|thumb|Print Backup TAN List]]
 
[[File:JUSTUS-2-2FA-backup-TAN-list.png|center|800px|thumb|Print Backup TAN List]]
   
4. Repeat the process to register additional tokens.
+
5. Repeat the process to register additional tokens.
  +
   
 
== Deactivating a Token ==
 
== Deactivating a Token ==
   
 
Click '''Disable''' next to the Token entry on the '''My Tokens''' screen.
 
Click '''Disable''' next to the Token entry on the '''My Tokens''' screen.
  +
   
 
== Deleting a Token ==
 
== Deleting a Token ==
   
 
After a Token has been disabled a new button labeled '''Delete''' will appear. Click on it to delete the token.
 
After a Token has been disabled a new button labeled '''Delete''' will appear. Click on it to delete the token.
  +
  +
= Returning Users =
  +
  +
Returning users who have already activated one or more tokens must first verify their token before they can create new tokens or deactivate/delete old ones.
  +
If you no longer have valid tokens, you will not be able to create or manage tokens.
  +
In this case, read the section [[Registration/2FA#Lost_Token|Lost Token]].
  +
[[File:BwIDM-totp.png|center|400px|thumb|Returning users must first verify their token.]]
   
 
= Lost Token =
 
= Lost Token =
   
If you have lost a token, please create a new one.
 
 
If you change your phone, please migrate your tokens first or register your new mobile app under "My Tokens".
 
If you change your phone, please migrate your tokens first or register your new mobile app under "My Tokens".
  +
'''If you no longer have valid tokens (mobile app, hardware token, Yubikey or backup TAN), you will need to contact the [https://bw-support.scc.kit.edu/ ticket system].'''
 
  +
'''If you no longer have valid tokens (mobile app, hardware token, Yubikey or backup TAN, i.e. lost or broken smartphone), you can not access the section "My Tokens" anymore.
  +
In this case you will need to contact the [https://bw-support.scc.kit.edu/ ticket system].'''
  +
Open a ticket, include your user name, the name of the bwHPC cluster and ask for a reset of your 2FA tokens.
 
Please note that this process may take some time and also means additional work for the operators.
 
Please note that this process may take some time and also means additional work for the operators.

Revision as of 13:01, 5 July 2022

1 Generate a Second Factor (2FA)

To improve security a 2-factor authentication mechanism (2FA) is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the second factor, has to be entered on every login.


1.1 How 2FA works

Attention.svg

It is very important that the device that generates the One-Time Passwords and the device which is used to log into the bwUniCluster/bwForClusters are not the same. Otherwise an attacker who gains access to your system can steal both the service password and the secret key of the Software Token application, which allows them to generate One-Time Passwords and log into the HPC system without your knowledge.

Hardware Token for TOTP

On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent one-time passwords (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a hardware token) or of a normal application running on a common device (a software token).

The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values (TOTPs) which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password.

Typically a new TOTP value is generated every 30 seconds. When the current TOTP value has once been used successfully for a login, it is depleted and one has to wait up to 30 seconds for the next TOTP value.


The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:

These are only suggestions. You can use any application compatible with the TOTP standard.

If you don't want to use a smartphone, we recommend using a hardware token, such as Yubikey or another TOTP-compatible device. Yubico OTP is also supported if you want to use your Yubikey without depending on having a six-digit code displayed. But you can also use the Yubikey as a generator for six-digit TOTP.


2 Token Management

Attention.svg
  • Create at least two separate tokens: FIRST set up a software/hardware TOTP token. THEN create and print a "backup TAN list". Never create the "backup TAN list" first.
  • If you lose access to all your tokens, you will not be able to create new tokens and support will have to reset your tokens manually.
  • The "backup TAN list" should always be created and printed in a second step. The printout should be kept in a separate place for emergencies.
  • Please clean up your second factors as soon as you have created new tokens. Tokens that can no longer be used (e.g. because not initialized, smartphone/Yubikey lost, etc.) or an old backup TAN list where you have already used all TANs or there is no printout should be deactivated and deleted.
  • Returning users who have already activated one or more tokens must first verify their token before they can create new tokens, see section Returning Users.
  • Please disable all privacy tools, ad blockers and further add-ons when registering new tokens. These tools prevent the registration website from generating new security tokens. When the problems remains (you can not generate the QR code or can not confirm it by clicking CHECK), please try once more with an entirely new unmodified web browser profile.

bwUniCluster/bwForCluster Tokens are generally managed via the Index -> My Tokens menu entry on the registration pages for the clusters. Here you can register, activate, deactivate and delete tokens.

To activate the second factor, please perform the following steps:

1. Select the registration server of the cluster for which you want to create a second factor and login to it:
Registration server for bwUniCluster 2.0 and bwForCluster JUSTUS 2 (2FA tokens are valid for both clusters; KIT members can reuse their existing hardware and software tokens)
Registration server for bwForCluster MLS&WISO

My Tokens

2. Register a new "Smartphone Token" or if you own a Yubikey register a new "Yubikey Token" or "Yubikey OATH TOTP Token".

3. Register a new "TAN List" (backup TAN list).

4. Repeat step 2. for additional tokens.


2.1 Registering a new Software Token using a Mobile APP

Attention.svg

Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.

1. Select the registration server of the cluster for which you want to create a second factor and login to it.

2. Registering a new Token starts with a click NEW SMARTPHONE TOKEN.

Create a new Token

3. A new window opens. Click Start to generate a new QR code. This may take a while.

Attention.svg

The QR code contains a key which has to remain secret. Only use the QR code to link your software token app with bwIDM/bwServices in the next step. Do not save the QR code, print it out or share it with someone else.

QR Code for Mobile App

4. Start the software token app on your separate device and scan the QR code. The exact process is a little bit different in every app, but is usually started by pressing on a button with a plus (+) sign or an icon of a QR code.

5. Once the QR code has been loaded into your Software Token app there should be a new entry called bwIDM (bwUniCluster and JUSTUS 2) or bwServices (MLS&WISO). Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item. You will receive a six-digit code. Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click CHECK.

Attention.svg

If you do not confirm the token by entering the six-digit code in the "Current code:" field, the token will NOT be initialized!

6. If everything worked as expected, you will be returned to the My Tokens screen and there will be a new entry for your software token.

Success

7. Repeat the process to register additional tokens. Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.


2.2 Registering a new Yubikey OTP Token

Attention.svg

Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.

Yubikey OTP is even easier and you don't need a device that displays the six-digit code or extra software. New Yubikeys are already configured to provide Yubikey OTP in slot 1. If you need to configure your Yubikey, read this documentation.

1. Select the registration server of the cluster for which you want to create a second factor and login to it.

2. If you want to use Yubico OTP, you can click NEW YUBIKEY TOKEN instead.

Generate Yubikey OTP

3. Yubikey OTP is configured to slot 1 on new Yubikeys, so you only need to click in the text box and then touch the metal part of your Yubikey. Please refer to this documentation on how to configure your Yubikey.

Yubikey OTP

4. If everything worked as expected, you will be returned to the My Tokens screen and there will be a new entry for your Yubikey.

Success

5. Repeat the process to register additional tokens. Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.


2.3 Registering a new Yubikey OATH TOTP Token

Attention.svg

Please disable all privacy tools, ad blockers and further add-ons when registering new tokens.

Yubikey OATH TOTP generates the TANs on your Yubikey and therefore you can use different computers and Android phones to generate these codes. Please download and install Yubico Authenticator for Desktop (or Android) first. Insert your Yubikey in your computer. "Yubikey OTP" (not "Yubikey OATH TOTP") is even easier and you don't need a device that displays the six-digit code or extra software (go to step Yubikey OTP).

1. Select the registration server of the cluster for which you want to create a second factor and login to it.

2. Registering a new Token starts with a click NEW SMARTPHONE TOKEN.

Create a new Token

3. A new window opens. Click Start to generate a new QR code. This may take a while.

Attention.svg

The QR code contains a key which has to remain secret. Only use the QR code to link your software token app with bwIDM/bwServices in the next step. Do not save the QR code, print it out or share it with someone else.

4. Start the Yubico Authenticator on your OS, click the three vertical dots in the upper right corner and select Scan QR code.

QR Code and Yubico Authenticator on Linux

5. Yubico Authenticator automatically translates the QR code to a new entry called bwIDM or bwServices (MLS&WISO). Click Add account.

Create new TOTP on Yubico Authenticator

6. You will receive a six-digit code. Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click CHECK.

Verify TOTP

7. If everything worked as expected, you will be returned to the My Tokens screen and there will be a new entry for your software token.

Success

8. Repeat the process to register additional tokens. Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.


2.4 Backup TAN List

Attention.svg

Passwords from the "Backup TAN list" should only be used if no other token is left. Please do not use the Backup TANs for regular cluster login, because you have only a limited number of TANs. Each TAN can only be used once. Please disable all privacy tools, ad blockers and further add-ons when registering a new Backup TAN list.

1. Select the registration server of the cluster for which you want to create a second factor and login to it.

2. Please create at least one "Backup TAN list" by clicking CREATE NEW TAN LIST.

Generate Backup TAN list

3. Click START. You will be redirected to the My Tokens screen and there will be a new entry for your backup TANs.

Success

4. Click SHOW TANS, print the codes and keep then in a separate place for emergencies.

Print Backup TAN List

5. Repeat the process to register additional tokens.


2.5 Deactivating a Token

Click Disable next to the Token entry on the My Tokens screen.


2.6 Deleting a Token

After a Token has been disabled a new button labeled Delete will appear. Click on it to delete the token.

3 Returning Users

Returning users who have already activated one or more tokens must first verify their token before they can create new tokens or deactivate/delete old ones. If you no longer have valid tokens, you will not be able to create or manage tokens. In this case, read the section Lost Token.

Returning users must first verify their token.

4 Lost Token

If you change your phone, please migrate your tokens first or register your new mobile app under "My Tokens".

If you no longer have valid tokens (mobile app, hardware token, Yubikey or backup TAN, i.e. lost or broken smartphone), you can not access the section "My Tokens" anymore. In this case you will need to contact the ticket system. Open a ticket, include your user name, the name of the bwHPC cluster and ask for a reset of your 2FA tokens. Please note that this process may take some time and also means additional work for the operators.