Pro Tip: Allowing Users to Set-up 2-Factor Authentication
With the explosion in brute-force attacks by cybercriminals, even implementing strong password-based authentication may not be enough to protect user accounts. Although Cells automatically detects brute-force by locking users after 10 failed login attempts in a row, adding 2-Factor Authentication (2FA) via a device owned by the user is now an accepted security best practice.
Cells make it fast and easy for end users to add two-factor authentication to a specific account. With Cells Enterprise, users can use “one time password” provided by Google Authenticator (or compatible applications), or even better a Yubikey hardware device to unlock their account. Here’s how it works.
[Update] New in Cells V3 : new support for Duo Security multifactor authentication!
A - Enable Multi-Factor Authentication (Admin)
As an admin, go to the Cells Console > Authentication page and enable the “One Time Password” plugin.
From there, users will be able to choose their preferred 2FA method from their user menu account, and choose either of two methods.
 |
 |
B - Configure 2FA (Users)
1 - Google Authenticator OTP (and other compatible apps)
For users, first install the Google Authenticator application (or any TOTP-compatible application like FreeOTP) on your smartphone. This app will generate unique tokens for authentication. It doesn’t store or access anything on your Pydio Cells instance.
To configure it, select the Google Authenticator option in Cells and scan the QR code provided with the app.
This will add an account to Authenticator and start generating tokens right away. To make sure it is working properly, you can enter the code and click on the TEST button. Once it’s validated, click on Save.
At next login, after login/password authentication, you’ll be presented with a dialog box to enter the Authenticator token.
2 - Configure Yubikey 2FA
Yubikey is a hardware dongle that must be inserted via USB in the computer where you log in. You first need to register that key to the yubi.co service and get a proper API Key / Secret.
Once you set up your Yubikey Client ID and Secret, use the test field to make sure it’s working. Insert the Yubikey, click in the text field and press the key to generate a unique string in the field automatically. If it’s ok, just save !
At next login, you will be prompted to with a text input field to perform the same “insert key and press” operation! Simple as that.
3 - Disable 2FA
Once you have setup 2FA, you can disable it by clicking on the “Multifactor Authentication” menu and selecting “RESET”.
Coming Next
In our next release, Cells Enterprise will ship with a new integration with Duo Security service, that provides additional security 2FA methods: push notification to Duo application on mobile phone, SMS code validation, etc… Stay tuned!
Need to Balance Ease-of-Use with Security? Pydio Cells Can Help.
If your organization is serious about secure document sharing and collaboration you need to check out Pydio Cells. Cells was developed specifically to help enterprises balance the need to collaborate effectively with the need to keep data secure.
With robust admin controls, advanced automation capabilities, and a seamless, intuitive end-user experience Pydio is the right choice for organizations looking to balance performance and security without compromising on either. Try Cells live for yourself. Or click on the button below to talk to a Pydio document sharing specialist.