Differences

This shows you the differences between two versions of the page.

--- manuals:vps:users [2017/02/12 14:13] – created Aither
+++ manuals:vps:users [2024/01/02 17:59] – Tokens -> user session log aither
@@ Line 31: / Line 31: @@
 {{navody:vps:user_mail_templates.png?300|}}
-===== Authentication tokens =====
+===== Two-factor authentication (2FA) =====
-Users can authenticate in vpsAdmin using HTTP basic or authentication tokens.
+Two-factor authentication for vpsAdmin using
-The latter can be seen and managed from vpsAdmin (vpsAdmin -> Edit profile ->
+[[wp>Time-based One-time Password algorithm|TOTP]]
-Authentication tokens).
+can be optionally enabled. You then need both the password and TOTP to log in.
-{{navody:vps:user_mail_templates.png?300|}}
+When enabled, the two-factor authentication is mandatory for access to
+your account: in the web interface, using [[manuals:vps:api|API]] and
+[[manuals:vps:api#cli|vpsfreectl]]. Only the
+[[manuals:vps:api#authentication|token authentication]] can be used, HTTP basic
+will cease to work.
-You can see a list of active authentication tokens, their lifetime and who
+FA can be enabled in profile settings (vpsAdmin -> Edit profile).
-created them. This list is useful when you have multiple long-lived tokens for
-various client applications.
-The web UI itself uses authentication tokens. You can create tokens using CLI
+{{:navody:vps:2fa_status.png?200|}}
-or any client library and label them, so you'll recognize them in the future.
+You can setup TOTP e.g. on your mobile phone using applications like
+[[https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2|Google Authenticator]]
+or [[https://freeotp.github.io|FreeOTP]].
+vpsAdmin will show you a QR code which you scan into the application. The 2FA
+activation is then confirmed when you enter the one-time password that the
+application will show you. Alternatively, instead of scanning the QR code,
+you can enter the secret key manually.
+{{:navody:vps:totp_device_confirm.png?300|}}
+Once activated, you will be given a recovery code. This code can be used when
+you lose access to your authentication device. Do not save this code together
+with your vpsAdmin password. If you lose both the authentication device and
+the recovery code, you will have to contact our support to recover your account.
+You can configure multiple TOTP devices and any one of them can be used to log in.
+Individual devices can be temporarily disabled or removed
+(vpsAdmin -> Edit profile -> TOTP devices).
+{{:navody:vps:totp_device_list.png?300|}}
 ===== Session log =====
 vpsAdmin logs all user sessions and remembers what actions were performed
 (vpsAdmin -> Edit profile -> Session log).
+{{:navody:vps:user-session-log.png?300}}
 You can see when the session started, ended, what authentication method was
-used, IP addresses, client idenfitication and a list of executed actions in a
+used, IP addresses, client identification and a list of executed actions in a
-particular session.
+particular session. Active sessions have a light green background. The current session
+which is used to view the page has dark green background. You can end active sessions
+by clicking on the trash bin icon.

Knowledge base

User Tools

Site Tools

Differences

Page Tools