2018-01-30 10:40:13 +00:00
|
|
|
=========================
|
|
|
|
|
Two-factor authentication
|
|
|
|
|
=========================
|
|
|
|
|
|
|
|
|
|
.. image:: images/two_factor_authentication.png
|
2018-07-31 14:51:11 +00:00
|
|
|
:width: 100%
|
2018-01-30 10:40:13 +00:00
|
|
|
|
|
|
|
|
Two-factor authentication also known as 2FA or 2-Step Verification is an authentication
|
|
|
|
|
method that requires two components, such as a pin/password + a token.
|
|
|
|
|
|
|
|
|
|
OPNsense (version >=16.1.14) offers support for Two-factor authentication throughout
|
|
|
|
|
the entire system, with one exception being console/ssh access.
|
|
|
|
|
|
|
|
|
|
Supported services are:
|
|
|
|
|
|
|
|
|
|
* OPNsense Graphical User Interface
|
|
|
|
|
* Captive Portal
|
|
|
|
|
* Virtual Private Networking - OpenVPN & IPsec
|
|
|
|
|
* Caching Proxy
|
|
|
|
|
|
2022-08-04 19:55:54 +00:00
|
|
|
New authentication servers can be added via :menuselection:`System -> Access -> Servers`, which supports
|
|
|
|
|
both local users and users synchronised via ldap.
|
2018-01-30 10:40:13 +00:00
|
|
|
|
|
|
|
|
----------------------------
|
|
|
|
|
Time-based One-time Password
|
|
|
|
|
----------------------------
|
|
|
|
|
TOTP is an algorithm that computes a one-time password from a shared secret key
|
|
|
|
|
and the current time. OPNsense supports RFC 6238.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
--------------------
|
|
|
|
|
Google Authenticator
|
|
|
|
|
--------------------
|
|
|
|
|
OPNsense fully supports the use of Google's Authenticator application.
|
|
|
|
|
This application can generate tokens on Android, iOS and BlackBerry OS.
|
|
|
|
|
The usage of this application is free and very simple to setup using OPNsense.
|
|
|
|
|
|
|
|
|
|
-----------------
|
|
|
|
|
Other TOTP tokens
|
|
|
|
|
-----------------
|
|
|
|
|
The 2FA feature can be used with any time based one-time password token, although
|
|
|
|
|
it may be necessary to convert the tokens seed to the used format (base32).
|
|
|
|
|
|
|
|
|
|
---------------------
|
|
|
|
|
Configuration & Setup
|
|
|
|
|
---------------------
|
|
|
|
|
To setup see: :doc:`how-tos/two_factor`.
|
