meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
account:mfa [2026/06/02 10:29] – hkunzaccount:mfa [2026/06/03 14:35] (current) – hkunz
Line 1: Line 1:
-====== Two-Factor Authentication @ IfI (2FA) ======+====== 2-Factor Authentication @ IfI (2FA) ======
  
 {{indexmenu_n>10}} {{indexmenu_n>10}}
Line 6: Line 6:
  
 If you are here for the first time, you probably want to setup your first 2nd factor. To start, we suggest you go with the //PUSH token// or a //TOTP token//. You find detailed instruction how to set them up below. If you are here for the first time, you probably want to setup your first 2nd factor. To start, we suggest you go with the //PUSH token// or a //TOTP token//. You find detailed instruction how to set them up below.
 +
 +</WRAP>
 +
 +<WRAP danger>
 +
 +If you feel completely overwhelmed and/or do not understand a word, we suggest to to dive in first with enrolling a PUSH or a TOTP token (scroll down for the step-by-step guides) and read then read the rest of this document afterwards. Chances are good, that things are much clearer then :)
  
 </WRAP> </WRAP>
Line 59: Line 65:
 To setup the PUSH token, do the following: To setup the PUSH token, do the following:
  
-  - Open [[https://pi.ifi.uzh.ch|PrivacyIDEA]], click on //Enroll Token//. The //PUSH//  token should be selected by default.+  - Open [[https://pi.ifi.uzh.ch|pi.ifi.uzh.ch]], click on //Enroll Token//. The //PUSH//  token should be selected by default.
   - Install the //PrivacyIDEA Authenticator//  on your phone. You can use the QR codes provided to do that.   - Install the //PrivacyIDEA Authenticator//  on your phone. You can use the QR codes provided to do that.
   - Add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.   - Add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.
Line 82: Line 88:
 For all Authenticator apps the procedure is basically the same: For all Authenticator apps the procedure is basically the same:
  
-  - Open [[https://pi.ifi.uzh.ch|PrivacyIDEA]], click on //Enroll Token //and choos the //TOTP//  token.+  - Open [[https://pi.ifi.uzh.ch|pi.ifi.uzh.ch]], click on //Enroll Token //and choos the //TOTP//  token.
   - If necessary, install the //PrivacyIDEA Authenticator//  on your phone. You can use the QR codes provided to do that.   - If necessary, install the //PrivacyIDEA Authenticator//  on your phone. You can use the QR codes provided to do that.
   - Add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.   - Add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.
Line 104: Line 110:
  
   - Insert the Yubikey, start the //YubiKey Authenticator//  and go to //Passkeys//. Unlock the passkey store with your PIN, or set a PIN if you have not done that yet.   - Insert the Yubikey, start the //YubiKey Authenticator//  and go to //Passkeys//. Unlock the passkey store with your PIN, or set a PIN if you have not done that yet.
-  - Open [[https://pi.ifi.uzh.ch|PrivacyIDEA]], click on //Enroll Token//  and choose the token type //Passkey//  add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.+  - Open [[https://pi.ifi.uzh.ch|pi.ifi.uzh.ch]], click on //Enroll Token//  and choose the token type //Passkey//  add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.
   - Depending on your environment, your password manager might pop-up and ask to store the passkey. Do not store the passkey there, instead close/cancel that dialog. A new dialog box should pop up, asking you for the PIN of your Yubikey passkey store. Enter the pin and follow the instructions, i.e. press the button on the Yubikey.   - Depending on your environment, your password manager might pop-up and ask to store the passkey. Do not store the passkey there, instead close/cancel that dialog. A new dialog box should pop up, asking you for the PIN of your Yubikey passkey store. Enter the pin and follow the instructions, i.e. press the button on the Yubikey.
   - Check the //YubiKey Authenticator//  for the just saved passkey.   - Check the //YubiKey Authenticator//  for the just saved passkey.
Line 117: Line 123:
   - Assign a //public ID//  or simply use the //serial//  (click the diamonds). Generate the //Private ID//  and the //Secret key//  (using the circular arrows).   - Assign a //public ID//  or simply use the //serial//  (click the diamonds). Generate the //Private ID//  and the //Secret key//  (using the circular arrows).
   - Copy the //Secret key//  and click //Save//.   - Copy the //Secret key//  and click //Save//.
-  - Open [[https://pi.ifi.uzh.ch|PrivacyIDEA]], click on //Enroll Token//  and choose the token type //Yubikey AES mode//.+  - Open [[https://pi.ifi.uzh.ch|pi.ifi.uzh.ch]], click on //Enroll Token//  and choose the token type //Yubikey AES mode//.
   - Paste the //Secret key//  (copied from the YubiKey Authenticator) to the// OTP Key//  field (PrivacyIDEA), add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.   - Paste the //Secret key//  (copied from the YubiKey Authenticator) to the// OTP Key//  field (PrivacyIDEA), add a //Description//  (to distinguish your tokens easily) and click //Enroll Token//.
  
Line 137: Line 143:
 <WRAP danger> <WRAP danger>
  
-Always protect your ssh (private) key with a passphrase. Never use a ssh keys with an empty passphrase, as everybody that gets hold on your keys could use them.+**Always protect your ssh (private) key with a passphrase**. **Never**  use a ssh keys with an empty passphrase, as everybody that gets hold on your keys could use them.
  
 </WRAP> </WRAP>
 +
 +<WRAP notice>
 +
 +Of course you want to avoid typing the passphrase each time you login. you can do that using **ssh-agent**. Here, you can unlock your (private) key once you login to your laptop/desktop and use it without passphrase (until you logout or shutdown your laptop/desktop).
 +
 +</WRAP>
 +
 +To setup key-based authentication and use the ssh-agent, please check the following tutorials (if necessary):
 +
 +  * [[https://www.digitalocean.com/community/tutorials/ssh-essentials-working-with-ssh-servers-clients-and-keys|SSH Essentials: Working with SSH Servers, Clients, and Keys]] (digital ocean)
 +  * [[https://www.digitalocean.com/community/tutorials/how-to-create-ssh-keys-with-openssh-on-macos-or-linux|Create SSH Keys with OpenSSH on macOS, Linux, or Window]]s (digital ocean)
 +
 +The second tutorial also explains how to use the ssh-agent.