Difference between revisions of "Registration/2FA"

From bwHPC Wiki
Jump to: navigation, search
m (Token Management)
m
Line 1: Line 1:
= Generate a Second Factor =
+
= Generate a Second Factor (2FA) =
   
 
To improve security a '''2-factor authentication mechanism (2FA)''' is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the '''second factor''', has to be entered on every login.
 
To improve security a '''2-factor authentication mechanism (2FA)''' is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the '''second factor''', has to be entered on every login.
   
= How 2FA works =
+
== How 2FA works ==
 
   
 
{|style="background:#deffee; width:100%;"
 
{|style="background:#deffee; width:100%;"
Line 40: Line 39:
 
|}
 
|}
   
= Token Management =
+
== Token Management ==
  +
  +
{|style="background:#deffee; width:100%;"
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
[[Image:Attention.svg|center|25px]]
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
Always create at least two separate tokens, for example for the mobile app and the "backup TAN list".
  +
If you lose access to all your tokens, you will not be able to create new tokens and support will have to reset your tokens manually.
  +
The "backup TAN list" should always be created and kept in a separate place for emergencies.
  +
|}
   
 
'''bwUniCluster/bwForCluster Tokens''' are generally managed via the '''My Tokens''' menu entry on the registration pages for the clusters. Here you can register, activate, deactivate and delete Tokens. Please select the Cluster you want to create a second factor:
 
'''bwUniCluster/bwForCluster Tokens''' are generally managed via the '''My Tokens''' menu entry on the registration pages for the clusters. Here you can register, activate, deactivate and delete Tokens. Please select the Cluster you want to create a second factor:
Line 49: Line 57:
 
[[File:BwIDM-twofa.png|center|My Tokens]]
 
[[File:BwIDM-twofa.png|center|My Tokens]]
   
== Registering a new Software or Hardware Token ==
+
=== Registering a new Software Token using a Mobile APP ===
   
1. Registering a new Token starts with a click on '''New smartphone token'''. If you happen to own a USB Hardware Token device made by the manufacturer '''[https://www.yubico.com Yubikey]''', you can click on '''New Yubikey Token''' instead.
+
1. Registering a new Token starts with a click '''NEW SMARTPHONE TOKEN'''.
  +
[[File:BwIDM-token.png|center|]]
 
[[File:BwUniCluster 2.0 2fa register new empty.png|center|]]
 
   
 
2. A new window opens. Click '''Start''' to generate a new '''QR code'''.
 
2. A new window opens. Click '''Start''' to generate a new '''QR code'''.
 
This may take a while.
 
This may take a while.
  +
{|style="background:#deffee; width:100%;"
 
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
'''NOTE: The QR code contains a key which has to remain secret.
 
  +
[[Image:Attention.svg|center|25px]]
Only use the QR code to link your Software Token app with bwIDM/bwServices in the next step.
 
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
o not save the QR code, print it out or share it with someone else.
 
  +
The QR code contains a key which has to remain secret.
You can always generate more codes later.'''
 
  +
Only use the QR code to link your software token app with bwIDM/bwServices in the next step.
 
  +
Do not save the QR code, print it out or share it with someone else.
[[File:BwUniCluster 2.0 2fa register new qr.png|center|]]
 
  +
|}
  +
[[File:BwUniCluster 2.0 2fa register new qr.png|center|600px|QR code]]
   
 
3. Start the software token app on your separate device and scan the QR code.
 
3. Start the software token app on your separate device and scan the QR code.
Line 71: Line 80:
 
Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item.
 
Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item.
 
You will receive a six-digit code.
 
You will receive a six-digit code.
Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click on '''Check'''.
+
Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click '''Check'''.
  +
  +
5. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your software token.
  +
[[File:BwIDM-app.png|center|Success]]
  +
  +
6. Repeat the process to register additional tokens.
  +
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
  +
  +
=== Yubikey OTP ===
  +
  +
1. If you want to use [https://www.yubico.com/resources/glossary/yubico-otp/ Yubico OTP], you can click '''NEW YUBIKEY TOKEN''' instead.
  +
[[File:BwIDM-token.png|center|Generate Yubikey OTP]]
  +
  +
2. Yubikey OTP is configured to slot 1 on new Yubikeys, so you only need to click in the text box and then touch the metal part of your Yubikey.
  +
Please check with [https://www.yubico.com Yubico] how to configure your Yubikey.
  +
[[File:BwIDM-yubikey.png|center|Yubikey OTP]]
  +
  +
3. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your Yubikey.
  +
[[File:BwIDM-yubikey2.png|center|Success]]
  +
  +
4. Repeat the process to register additional tokens.
  +
Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.
  +
  +
=== Backup TAN List ===
  +
  +
{|style="background:#deffee; width:100%;"
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
[[Image:Attention.svg|center|25px]]
  +
|style="padding:5px; background:#cef2e0; text-align:left"|
  +
Passwords from the "Backup TAN list" should only be used if no other token is left.
  +
Please do not use the Backup TANs for regular cluster login, because you have only a limited number of TANs.
  +
|}
  +
  +
1. Please create at least one "Backup TAN list" by clicking '''CREATE NEW TAN LIST'''.
  +
[[File:BwIDM-token.png|center|Generate Backup TAN list]]
  +
  +
2. Click '''START'''. You will be redirected to the '''My Tokens''' screen and there will be a new entry for your backup TANs.
  +
[[File:BwIDM-tan.png|center|Success]]
  +
  +
3. Click '''SHOW TANS''', print the codes and keep then in a separate place for emergencies.
   
  +
4. Repeat the process to register additional tokens.
5. If everything worked as expected, you will be returned to the '''My Tokens''' screen and there will be a new entry for your Software Token:
 
   
  +
=== Deactivating a Token ===
[[File:BwUniCluster 2.0 2fa register new success.png|center|]]
 
   
  +
Click '''Disable''' next to the Token entry on the '''My Tokens''' screen.
6. Repeat the process to register additional tokens. '''Please register at least a Backup TAN list in addition to the hardware/software token you plan to use regularly. If you only register a single token and happen to lose access to it, e.g. because you lose your device, uninstall the software token application or data gets deleted/corrupted, you will neither be able to log into the cluster system nor register a new token.''' The [[BwUniCluster 2.0 Support|support channels]] are able to deactivate your lost token, but this process will take its time.
 
   
= Deactivating a Token =
+
=== Deleting a Token ===
   
  +
After a Token has been disabled a new button labeled '''Delete''' will appear. Click on it to delete the token.
Click on the '''Disable''' button next to the Token entry on the '''My Tokens''' screen.
 
   
= Deleting a Token =
+
== Lost Token ==
   
  +
If you have lost a token please create a new one.
After a Token has been disabled a new button labeled '''Delete''' will appear. Click on it to delete the Token.
 
  +
If you switch your phone, please migrate your tokens first or register your new mobile app.
  +
'''If you don't have any valid tokens left (mobile app, hardware token, Yubikey or backup TAN) you'll need to contact the [https://bw-support.scc.kit.edu/| ticket system].'''
  +
This process will take some time.

Revision as of 19:36, 18 January 2022

1 Generate a Second Factor (2FA)

To improve security a 2-factor authentication mechanism (2FA) is being enforced for logins to bwUniCluster/bwForClusters. In addition to the service password a second value, the second factor, has to be entered on every login.

1.1 How 2FA works

Attention.svg

It is very important that the device that generates the One-Time Passwords and the device which is used to log into the bwUniCluster/bwForClusters are not the same. Otherwise an attacker who gains access to your system can steal both the service password and the secret key of the Software Token application, which allows them to generate One-Time Passwords and log into the HPC system without your knowledge.

On the bwUniCluster/bwForClusters we use six-digit, auto-generated, time-dependent One-Time Passwords (TOTP). These passwords are generated by a piece of software which is part of a special hardware device (a Hardware Token) or of a normal application running on a common device (a Software Token).

The Token has to be synchronized with a central server before it can be used for authentication and then generates an endless stream of six-digit values which can only be used once and are only valid during a very short interval of time. This makes it much harder for potential attackers to access the HPC system, even if they know the regular service password.

Yubico OTP also supported if you want to use your Yubikey without depending on having a six-digit code displayed. But you can also use the Yubikey as a generator for six-digit TOTP.

Hardware Token for TOTP
The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:

These are only suggestions. You can use any application compatible with the TOTP standard.

TOTP Authenticator displaying generated One-Time Passwords for various services (source: https://getaegis.app)

1.2 Token Management

Attention.svg

Always create at least two separate tokens, for example for the mobile app and the "backup TAN list". If you lose access to all your tokens, you will not be able to create new tokens and support will have to reset your tokens manually. The "backup TAN list" should always be created and kept in a separate place for emergencies.

bwUniCluster/bwForCluster Tokens are generally managed via the My Tokens menu entry on the registration pages for the clusters. Here you can register, activate, deactivate and delete Tokens. Please select the Cluster you want to create a second factor:

My Tokens

1.2.1 Registering a new Software Token using a Mobile APP

1. Registering a new Token starts with a click NEW SMARTPHONE TOKEN.

BwIDM-token.png

2. A new window opens. Click Start to generate a new QR code. This may take a while.

Attention.svg

The QR code contains a key which has to remain secret. Only use the QR code to link your software token app with bwIDM/bwServices in the next step. Do not save the QR code, print it out or share it with someone else.

QR code

3. Start the software token app on your separate device and scan the QR code. The exact process is a little bit different in every app, but is usually started by pressing on a button with a plus (+) sign or an icon of a QR code.

4. Once the QR code has been loaded into your Software Token app there should be a new entry called bwIDM or bwServices (MLS&WISO). Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item. You will receive a six-digit code. Enter this code into the field labeled "Current code:" in your bwIDM browser window to prove that the connection has worked and then click Check.

5. If everything worked as expected, you will be returned to the My Tokens screen and there will be a new entry for your software token.

Success

6. Repeat the process to register additional tokens. Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.

1.2.2 Yubikey OTP

1. If you want to use Yubico OTP, you can click NEW YUBIKEY TOKEN instead.

Generate Yubikey OTP

2. Yubikey OTP is configured to slot 1 on new Yubikeys, so you only need to click in the text box and then touch the metal part of your Yubikey. Please check with Yubico how to configure your Yubikey.

Yubikey OTP

3. If everything worked as expected, you will be returned to the My Tokens screen and there will be a new entry for your Yubikey.

Success

4. Repeat the process to register additional tokens. Please register at least the "Backup TAN list" in addition to the hardware/software token you plan to use regularly.

1.2.3 Backup TAN List

Attention.svg

Passwords from the "Backup TAN list" should only be used if no other token is left. Please do not use the Backup TANs for regular cluster login, because you have only a limited number of TANs.

1. Please create at least one "Backup TAN list" by clicking CREATE NEW TAN LIST.

Generate Backup TAN list

2. Click START. You will be redirected to the My Tokens screen and there will be a new entry for your backup TANs.

Success

3. Click SHOW TANS, print the codes and keep then in a separate place for emergencies.

4. Repeat the process to register additional tokens.

1.2.4 Deactivating a Token

Click Disable next to the Token entry on the My Tokens screen.

1.2.5 Deleting a Token

After a Token has been disabled a new button labeled Delete will appear. Click on it to delete the token.

1.3 Lost Token

If you have lost a token please create a new one. If you switch your phone, please migrate your tokens first or register your new mobile app. If you don't have any valid tokens left (mobile app, hardware token, Yubikey or backup TAN) you'll need to contact the ticket system. This process will take some time.