WikiSuite | How to install Two Factor Authentication for ClearOS

2021-07-20: WikiSuite will now support all major Linux distros. Thus, the information below is no longer updated. It may still be valid, or not. It will be eventually removed from this site, so anything relevant should be moved to the appropriate site. For anything related to ClearOS, please search among the following: ClearOS site, code base, Developer docs, Wiki or forum.

Please contact us if you would like to help out.

Within a few minutes of your ClearOS instance being on a public IP, there will be a flood of attempts to compromise it. So you should use a very strong password. Even better is to set up Two Factor Authentication.

Two-factor authentication (2FA) for Webconfig strengthens access security by requiring two methods to verify a user's identity. Before granting access to resources available via Webconfig, a user will be sent a random code after their username and password credentials have been verified. Failure to provide the correct code within a pre-determined window of time will result in access denial. 2FA for Webconfig can be enabled for root login or any user account.

This protects the ClearOS admin panel (Webconfig). Once you are logged in, you can use the Dynamic Firewall to temporarily permit access to other apps (SSH, VPN, etc)

Install

From the Marketplace

Install from web interface (in the System section), like all the other apps.

Manually

2FA for Webconfig on a ClearOS 7

yum install app-two-factor-auth

Once installed, find the relevant admin panel and configure for your needs.

The information about the configuration is at /etc/clearos/two_factor_auth.conf (useful if you can't log in via the ClearOS admin panel because you are not receiving the emails)

Sending to more than one email

If you need to add more than one email address (which is typical for the root account, just create a redirect ( rootmfa at example.org -> joe at example.org and jane at example.org and use mail forwarding.