Two-factor authentication (2FA)


Summary

This article provides summary on how you can configure Two Factor authentication (2FA) in MachPanel.

Applies To
This article applies to MachPanel Build v6 and above.
Two Factor Authentication (2FA):

Two Factor Authentication, also known as 2FA, two step verification or TFA (as an acronym), is an extra layer of security that is known as "multi factor authentication" that requires not only a password and username but also something that only, and only, that user has on them, i.e. a piece of information only they know.

  1. To Configure 2FA settings in MachPanel, navigate to the following path: Home » System Configuration » Authentication. Select Two Factor Authentication Settings tab.
  2. Check Enabled All sorts of options are possible to entertain different scenarios about enabling/disabling 2FA on different levels (Staff/Resellers/Customers) using the checkboxes highlighted below:
    1. Enabled: Enabled will enable the option globally without affecting any users. It is up to the user to enable/disable the option for himself/herself.
    2. Enable by default for new (i) Customers (ii) Resellers (iii) Staff Users: This means that after saving configuration having this checkbox enabled, the respective new Customer/Reseller/Staff will have the option to use 2FA enabled by default.
    3. Update Existing Users: This option will update existing users based on the previous settings.
      1. If only "a" is Checked and "b" is Unchecked, the option will be disabled for existing Customers/Resellers/Staff.
      2. If "a" and "b" both are Checked, it means that option will be enabled for existing Customers/Resellers/Staff.

 

 For 2FA Settings Authenticate Using following:

  1. Send PIN through Email
  2. Send PIN through SMS
  3. Authenticator App
Send PIN through Email:

Select PIN expires in Minutes. Save Settings

You can configure Email address at following path: Home > System Configuration > Emails Configuration > Email Templates

Send PIN through SMS

For this option you have to navigate to System Configuration > SMS Setting

 

Provide Twilio API Settings.

  1. Account SID: Here provide the twilio Account SID.
  2. Auth Token: Provide twilio account authentication token
  3. Number: Provide your number.
  4. Twilio API URL: Provide the Twilio API URL.


SMS Templates
Navigate to System Configuration > SMS Setting >SMS Template Add "Templates" for the PIN SMS to be sent. See snapshot below:

Authenticator App

Mobile Authenticator App can be used to enable App Authentication in MachPanel.The Duo Authentication is also supported.

How Login Works for Authenticator app?

  1. 1st time login
    1. After password is verified
    2. User is shown a QR code
    3. User will scan QR code using any app, suggested apps are (Google Authenticator, Microsoft Authenticator, Authy 2-Factor Authentication)
    4. When QR code is scanned, user will get 6-digit auth code in application.
      1. Warning: Code changes in 30 seconds.

         

      2. 6-digit TOTP Code in application

           3. In case user account is duplicated, then latest one will be valid.

       

    5.   ​User will input code, if code is accepted user is logged in.
  2. Returning user login
    1. Same as 1st time login but no need to scan QR code.
    2. User just needs to enter code from his mobile app.

  3. Reset Authenticator App.
    1. Needed in case user lost his device, or reinstalled app and does not have code available.
    2. Click on Re-Authenticate your mobile authenticator app link.
    3. Enter registered email address and hit Submit to get secret key on your registered email address:

    4. Check your email for secret key and enter the received secret key on Step 2 and hit "Re-Authenticate your mobile authenticator app" button:

    1. Finally you will be taken to login screen, where you can enter your login/password and then you will be asked to register a new authenticator app.