Difference between revisions of "Two-Factor Authentication"
(→Introduction) |
m |
||
| Line 1: | Line 1: | ||
| − | |||
| − | |||
==Introduction== | ==Introduction== | ||
| − | Two-Factor Authentication adds | + | Two-Factor Authentication adds a layer of security by adding a second step to the login process. It takes something you know (for example, your password) and adds a second factor, typically something you have (such as your phone). Since you require both to log in, this decreases the threat of a leaked password. |
| − | + | WHMCS includes three Two-Factor Authentication services. | |
===Time Based Tokens=== | ===Time Based Tokens=== | ||
| − | One of the most common and simplest forms of Two-Factor Authentication is Time Based Tokens. With Time Based Tokens, in addition to your regular username | + | One of the most common and simplest forms of Two-Factor Authentication is Time Based Tokens. With Time Based Tokens, in addition to your regular username and password, you also have to enter a 6-digit code that regenerates every 30 seconds. Only your token device (typically a mobile smartphone app) will have your secret key and be able to generate valid one-time passwords for your account. We recommend enabling Time Based Tokens (WHMCS enables this by default). |
===DuoSecurity=== | ===DuoSecurity=== | ||
| − | With DuoSecurity, you | + | With DuoSecurity, the system will prompt you for a phone number and present an option to receive a text or phone call. After you receive the text or phone call, input the authentication code to proceed. A second optional page at initial login will prompt to download the DuoSecurity mobile application. This application performs push notifications, allowing you to restrict or allow access under your user from your phone. |
| − | + | For more information, see [http://docs.whmcs.com/Duo_Security Duo Security]. | |
===YubiKey=== | ===YubiKey=== | ||
| − | YubiKey creates a one time password | + | YubiKey creates a one time password in a USB drive that acts as a keyboard to your computer. These are physical devices that you must purchase from Yubico directly. A purchase link is available in WHMCS. |
==Enabling Two-Factor Authentication== | ==Enabling Two-Factor Authentication== | ||
| Line 27: | Line 25: | ||
To enable Two-Factor Authentication on an installation, follow the steps below: | To enable Two-Factor Authentication on an installation, follow the steps below: | ||
| − | # From the Admin Area, begin by navigating to ''Setup > Staff Management > Two-Factor Authentication'' | + | # From the Admin Area, begin by navigating to ''Setup > Staff Management > Two-Factor Authentication''. |
| − | # Click the ''Activate'' button under the service that you would like to enable | + | # Click the ''Activate'' button under the service that you would like to enable. |
| − | # Select one or both of the ''Enable for use by Clients'' and ''Enable for use by Administrative Users'' options | + | # Select one or both of the ''Enable for use by Clients'' and ''Enable for use by Administrative Users'' options. |
| − | # If applicable, complete any additional ''Configuration Settings'' | + | # If applicable, complete any additional ''Configuration Settings''. |
| − | # Click on the ''Save'' button | + | # Click on the ''Save'' button. |
| − | + | You can repeat these steps for each service that you would like to enable. | |
[[File:2FA_001.png|border|800px]] | [[File:2FA_001.png|border|800px]] | ||
| Line 39: | Line 37: | ||
===Global Two-Factor Authentication Settings=== | ===Global Two-Factor Authentication Settings=== | ||
| − | The ''Global Two-Factor Authentication Settings'' options allow you to forcibly enable Two-Factor Authentication for Client | + | The ''Global Two-Factor Authentication Settings'' options allow you to forcibly enable Two-Factor Authentication for Client or Administrator Users on their next login. |
| − | To | + | To use this feature, select the options you would like, and click the ''Save Changes'' button. If a user has not yet configured Two-Factor Authentication, the system will force them to the next time they sign into WHMCS. |
[[File:2FA_002.png|border|800px]] | [[File:2FA_002.png|border|800px]] | ||
| Line 47: | Line 45: | ||
==Using Two-Factor Authentication== | ==Using Two-Factor Authentication== | ||
| − | Clients and Administrator Users can begin to use Two-Factor Authentication after one or more services | + | Clients and Administrator Users can begin to use Two-Factor Authentication after you have activated one or more services and configured the installation. |
===Within the Client Area=== | ===Within the Client Area=== | ||
| Line 55: | Line 53: | ||
The following steps demonstrate how Client Users can setup Two-Factor Authentication on their account using the ''Time Based Tokens'' service. | The following steps demonstrate how Client Users can setup Two-Factor Authentication on their account using the ''Time Based Tokens'' service. | ||
| − | # From the Client Area, | + | # From the Client Area, navigate to ''Hello, Name! > Security Settings''. |
| − | # Click on the ''Click here to Enable'' button | + | # Click on the ''Click here to Enable'' button. |
| − | # Select the ''Time Based Tokens'' service | + | # Select the ''Time Based Tokens'' service. |
| − | # Click on the ''Get Started'' button | + | # Click on the ''Get Started'' button. |
| − | # Scan the QR code with an authenticator app such as Google Authenticator or Duo Mobile | + | # Scan the QR code with an authenticator app, such as Google Authenticator or Duo Mobile. |
| − | # Enter in the 6-digit code that the authenticator app generates | + | # Enter in the 6-digit code that the authenticator app generates. |
| − | # Click on the ''Submit'' button | + | # Click on the ''Submit'' button. |
| − | # Record the ''Backup Code'' in a safe place | + | # Record the ''Backup Code'' in a safe place. |
| − | # Click the ''Close'' button | + | # Click the ''Close'' button. |
[[File:2FA_003.png|border|800px]] | [[File:2FA_003.png|border|800px]] | ||
| Line 71: | Line 69: | ||
[[File:2FA_005.png|thumb|Configuring Time Based Tokens in Admin Area]] | [[File:2FA_005.png|thumb|Configuring Time Based Tokens in Admin Area]] | ||
| − | In turn, Administrator Users can perform the following actions to | + | In turn, Administrator Users can perform the following actions to set up Two-Factor Authentication on their accounts using the ''Time Based Tokens'' service. |
| − | # From the Admin Area, begin by navigating to the ''My Account'' section | + | # From the Admin Area, begin by navigating to the ''My Account'' section. |
| − | # Toggle the ''Two-Factor Authentication'' setting to ''On'' | + | # Toggle the ''Two-Factor Authentication'' setting to ''On''. |
| − | # Select the ''Time Based Tokens'' service | + | # Select the ''Time Based Tokens'' service. |
| − | # Click on the ''Get Started'' button | + | # Click on the ''Get Started'' button. |
| − | # Scan the QR code with an authenticator app such as Google Authenticator or Duo Mobile | + | # Scan the QR code with an authenticator app, such as Google Authenticator or Duo Mobile. |
| − | # Enter in the 6-digit code that the authenticator app generates | + | # Enter in the 6-digit code that the authenticator app generates. |
| − | # Click on the ''Submit'' button | + | # Click on the ''Submit'' button. |
| − | # Record the ''Backup Code'' in a safe place | + | # Record the ''Backup Code'' in a safe place. |
| − | # Click the ''Close'' button | + | # Click the ''Close'' button. |
[[File:2FA_004.png|border|800px]] | [[File:2FA_004.png|border|800px]] | ||
| Line 88: | Line 86: | ||
'''The code you entered did not match what was expected. Please try again.'''<br /><br /> | '''The code you entered did not match what was expected. Please try again.'''<br /><br /> | ||
| − | Seeing this error when using the time based tokens method means that the 6 characters | + | Seeing this error when using the time based tokens method means that the 6 characters your device generated do not match the 6 numbers WHMCS expected. Usually, this indicates that the time on your device (for example, your phone or tablet) and on the WHMCS server are different. |
| − | You can see the time in the top-right corner of your WHMCS Admin Area. It's taken directly from your server's PHP configuration. You must ensure the server time is correct, and the time on your device matches the server time. For example | + | You can see the time in the top-right corner of your WHMCS Admin Area. It's taken directly from your server's PHP configuration. You must ensure the server time is correct, and the time on your device matches the server time. For example, if the server time is 00:01 and the time on your device is 00:00, you will see this error. In that scenario, you must change the time on your device to 00:01 so that they both match. |
| − | Syncing the server with [http://en.wikipedia.org/wiki/Network_Time_Protocol NTP] to ensure the time is exactly right may also help to resolve this. Most servers will revert to the internal hardware clock on reboot | + | Syncing the server with [http://en.wikipedia.org/wiki/Network_Time_Protocol NTP] to ensure the time is exactly right may also help to resolve this. Most servers will revert to the internal hardware clock on boot or reboot, so you will need to sync any changes from NTP to the hardware clock. |
| − | + | This provides support for time zone differences, so they are unlikely to cause problems. | |
'''The second factor you supplied was incorrect. Please try again.'''<br /><br /> | '''The second factor you supplied was incorrect. Please try again.'''<br /><br /> | ||
| − | Seeing this error when activating the DuoSecurity method for the first time means that the code | + | Seeing this error when activating the DuoSecurity method for the first time means that the entered code does not match what DuoSecurity expects. This indicates that the time on your server does not match DuoSecurity's clocks. |
| − | You can see the time in the top-right corner of your WHMCS admin area. It's taken directly from your server's PHP configuration. | + | You can see the time in the top-right corner of your WHMCS admin area. It's taken directly from your server's PHP configuration. You must ensure that the server time is synced exactly with UTC. For example, if the server time is 00:01 and the time at DuoSecurity is 00:00, you will see this error. |
| − | Syncing the server with [http://en.wikipedia.org/wiki/Network_Time_Protocol NTP] to ensure the time is exactly right will resolve this. Most servers will revert to the internal hardware clock | + | Syncing the server with [http://en.wikipedia.org/wiki/Network_Time_Protocol NTP] to ensure the time is exactly right will resolve this. Most servers will revert to the internal hardware clock when they boot or reboot, so you will need to sync any changes from NTP to the hardware clock. |
| − | + | This provides support for time zone differences, so they are unlikely to cause problems. | |
Revision as of 16:59, 30 April 2020
Contents
Introduction
Two-Factor Authentication adds a layer of security by adding a second step to the login process. It takes something you know (for example, your password) and adds a second factor, typically something you have (such as your phone). Since you require both to log in, this decreases the threat of a leaked password.
WHMCS includes three Two-Factor Authentication services.
Time Based Tokens
One of the most common and simplest forms of Two-Factor Authentication is Time Based Tokens. With Time Based Tokens, in addition to your regular username and password, you also have to enter a 6-digit code that regenerates every 30 seconds. Only your token device (typically a mobile smartphone app) will have your secret key and be able to generate valid one-time passwords for your account. We recommend enabling Time Based Tokens (WHMCS enables this by default).
DuoSecurity
With DuoSecurity, the system will prompt you for a phone number and present an option to receive a text or phone call. After you receive the text or phone call, input the authentication code to proceed. A second optional page at initial login will prompt to download the DuoSecurity mobile application. This application performs push notifications, allowing you to restrict or allow access under your user from your phone.
For more information, see Duo Security.
YubiKey
YubiKey creates a one time password in a USB drive that acts as a keyboard to your computer. These are physical devices that you must purchase from Yubico directly. A purchase link is available in WHMCS.
Enabling Two-Factor Authentication
To enable Two-Factor Authentication on an installation, follow the steps below:
- From the Admin Area, begin by navigating to Setup > Staff Management > Two-Factor Authentication.
- Click the Activate button under the service that you would like to enable.
- Select one or both of the Enable for use by Clients and Enable for use by Administrative Users options.
- If applicable, complete any additional Configuration Settings.
- Click on the Save button.
You can repeat these steps for each service that you would like to enable.
Global Two-Factor Authentication Settings
The Global Two-Factor Authentication Settings options allow you to forcibly enable Two-Factor Authentication for Client or Administrator Users on their next login.
To use this feature, select the options you would like, and click the Save Changes button. If a user has not yet configured Two-Factor Authentication, the system will force them to the next time they sign into WHMCS.
Using Two-Factor Authentication
Clients and Administrator Users can begin to use Two-Factor Authentication after you have activated one or more services and configured the installation.
Within the Client Area
The following steps demonstrate how Client Users can setup Two-Factor Authentication on their account using the Time Based Tokens service.
- From the Client Area, navigate to Hello, Name! > Security Settings.
- Click on the Click here to Enable button.
- Select the Time Based Tokens service.
- Click on the Get Started button.
- Scan the QR code with an authenticator app, such as Google Authenticator or Duo Mobile.
- Enter in the 6-digit code that the authenticator app generates.
- Click on the Submit button.
- Record the Backup Code in a safe place.
- Click the Close button.
Within the Admin Area
In turn, Administrator Users can perform the following actions to set up Two-Factor Authentication on their accounts using the Time Based Tokens service.
- From the Admin Area, begin by navigating to the My Account section.
- Toggle the Two-Factor Authentication setting to On.
- Select the Time Based Tokens service.
- Click on the Get Started button.
- Scan the QR code with an authenticator app, such as Google Authenticator or Duo Mobile.
- Enter in the 6-digit code that the authenticator app generates.
- Click on the Submit button.
- Record the Backup Code in a safe place.
- Click the Close button.
Troubleshooting
The code you entered did not match what was expected. Please try again.
Seeing this error when using the time based tokens method means that the 6 characters your device generated do not match the 6 numbers WHMCS expected. Usually, this indicates that the time on your device (for example, your phone or tablet) and on the WHMCS server are different.
You can see the time in the top-right corner of your WHMCS Admin Area. It's taken directly from your server's PHP configuration. You must ensure the server time is correct, and the time on your device matches the server time. For example, if the server time is 00:01 and the time on your device is 00:00, you will see this error. In that scenario, you must change the time on your device to 00:01 so that they both match.
Syncing the server with NTP to ensure the time is exactly right may also help to resolve this. Most servers will revert to the internal hardware clock on boot or reboot, so you will need to sync any changes from NTP to the hardware clock.
This provides support for time zone differences, so they are unlikely to cause problems.
The second factor you supplied was incorrect. Please try again.
Seeing this error when activating the DuoSecurity method for the first time means that the entered code does not match what DuoSecurity expects. This indicates that the time on your server does not match DuoSecurity's clocks.
You can see the time in the top-right corner of your WHMCS admin area. It's taken directly from your server's PHP configuration. You must ensure that the server time is synced exactly with UTC. For example, if the server time is 00:01 and the time at DuoSecurity is 00:00, you will see this error.
Syncing the server with NTP to ensure the time is exactly right will resolve this. Most servers will revert to the internal hardware clock when they boot or reboot, so you will need to sync any changes from NTP to the hardware clock.
This provides support for time zone differences, so they are unlikely to cause problems.