Difference between revisions of "Two-Factor Authentication"
(→Introduction) |
|||
| Line 5: | Line 5: | ||
Two-Factor Authentication adds an additional layer of security by adding a second step to the login process. It takes something you know (i.e. your password) and adds a second factor, typically something you have (such as your phone). Since both are required to log in, the threat of a leaked password is lessened. | Two-Factor Authentication adds an additional layer of security by adding a second step to the login process. It takes something you know (i.e. your password) and adds a second factor, typically something you have (such as your phone). Since both are required to log in, the threat of a leaked password is lessened. | ||
| − | Below is a brief summary of the three Two-Factor Authentication services included with WHMCS. | + | Below is a brief summary of the three Two-Factor Authentication services included with WHMCS. |
===Time Based Tokens=== | ===Time Based Tokens=== | ||
Revision as of 12:11, 20 March 2020
Two-Factor Authentication
Contents
Introduction
Two-Factor Authentication adds an additional layer of security by adding a second step to the login process. It takes something you know (i.e. your password) and adds a second factor, typically something you have (such as your phone). Since both are required to log in, the threat of a leaked password is lessened.
Below is a brief summary of the three Two-Factor Authentication services included with WHMCS.
Time Based Tokens
One of the most common and simplest forms of Two-Factor Authentication is Time Based Tokens. With Time Based Tokens, in addition to your regular username & password, you also have to enter a 6 digit code that re-generates every 30 seconds. Only your token device (typically a mobile smartphone app) will know your secret key and be able to generate valid one time passwords for your account. We recommend enabling Time Based Tokens (also enabled by default).
DuoSecurity
With DuoSecurity, you will be prompted for a phone number and option to receive a text or phone call. After the text or phone call is received, input the authentication code to proceed. A second optional page at initial login will prompt to download the DuoSecurity mobile application. This application is used to perform push notifications, allowing you to restrict or allow access under your user from your phone.
Detailed configuration instructions are located at http://docs.whmcs.com/Duo_Security
YubiKey
YubiKey creates a one time password stored within a USB drive that acts as a keyboard to your computer. These are physical devices that need to be purchased from Yubico directly. A purchase link is available inside WHMCS.
Enabling Two-Factor Authentication
To enable Two-Factor Authentication on an installation, follow the steps below:
- From the Admin Area, begin by navigating to Setup > Staff Management > Two-Factor Authentication
- Click the Activate button under the service that you would like to enable
- Select one or both of the Enable for use by Clients and Enable for use by Administrative Users options
- If applicable, complete any additional Configuration Settings
- Click on the Save button
These steps can be repeated for each service that you would like to enable.
Global Two-Factor Authentication Settings
The Global Two-Factor Authentication Settings options allow you to forcibly enable Two-Factor Authentication for Client and/or Administrator Users on their next login.
To utilise this feature select the options you would like, and click the Save Changes button. If a user has not yet configured Two-Factor Authentication, then they will be forced to do so the next time they sign into WHMCS.
Using Two-Factor Authentication
Clients and Administrator Users can begin to use Two-Factor Authentication after one or more services have been activated and configured on the installation.
Within the Client Area
The following steps demonstrate how Client Users can setup Two-Factor Authentication on their account using the Time Based Tokens service.
- From the Client Area, being by navigating to Hello, Name! > Security Settings
- Click on the Click here to Enable button
- Select the Time Based Tokens service
- Click on the Get Started button
- Scan the QR code with an authenticator app such as Google Authenticator or Duo Mobile
- Enter in the 6-digit code that the authenticator app generates
- Click on the Submit button
- Record the Backup Code in a safe place
- Click the Close button
Within the Admin Area
In turn, Administrator Users can perform the following actions to setup Two-Factor Authentication on their account using the Time Based Tokens service.
- From the Admin Area, begin by navigating to the My Account section
- Toggle the Two-Factor Authentication setting to On
- Select the Time Based Tokens service
- Click on the Get Started button
- Scan the QR code with an authenticator app such as Google Authenticator or Duo Mobile
- Enter in the 6-digit code that the authenticator app generates
- Click on the Submit button
- Record the Backup Code in a safe place
- Click the Close button
Troubleshooting
The code you entered did not match what was expected. Please try again.
Seeing this error when using the time based tokens method means that the 6 characters generated by your device do not match the 6 numbers WHMCS expected. This is caused by the time on your device (phone, tablet etc) and the server where WHMCS is installed being different.
You can see the time in the top-right corner of your WHMCS Admin Area. It's taken directly from your server's PHP configuration. You must ensure the server time is correct, and the time on your device matches the server time. For example: if the server time is 00:01 and the time on your device is 00:00, you will see this error. In that scenario, you must change the time on your device to 00:01 so that they both match.
Syncing the server with NTP to ensure the time is exactly right may also help to resolve this. Most servers will revert to the internal hardware clock on reboot/power on, so you will need to sync any changes from NTP to the hardware clock as well.
Different time-zones are taken into account, so time-zone differences won't cause a problem.
The second factor you supplied was incorrect. Please try again.
Seeing this error when activating the DuoSecurity method for the first time means that the code being entered does not match that which DuoSecurity expects. This is caused by the time on your server not matching DuoSecurity's clocks.
You can see the time in the top-right corner of your WHMCS admin area. It's taken directly from your server's PHP configuration. So you must ensure the server time is synced exactly with UTC. For example: if the server time is 00:01 and the time at DuoSecurity is 00:00, you will see this error.
Syncing the server with NTP to ensure the time is exactly right will resolve this. Most servers will revert to the internal hardware clock on reboot/power on, so you will need to sync any changes from NTP to the hardware clock as well.
Different time-zones are taken into account, so time-zone differences won't cause a problem.