Administrator Tasks for Multifactor Authentication
Note
Root user privilege is required for all commands except for logging in.
Voradmin Commands
The Multifactor Authentication command group contains the following commands:
Syntax voradmin mfa [ config | login | ssh_enable | ssh_disable | set_auth | set_timeout]
voradmin mfa config
Displays configuration information.
Syntax
voradmin mfa config
Response
Host Mfa Enable is not set.
MFA enabled guardpath(s) (Number of paths: 2):
/home/work1/gp_mfa
/home/work1/gp_mfa
MFA Exempt-List: (Number of entries: 1)
uid:1001, gid:1001, user: "malfoy", group: "wizards", domain(s): ""
OIDC configuration:
client-id : cte-client-malfoy-1
url : https://www.keycloak-sj1.org:8443/realms/cte-linux/.well-known/openid-configuration
ssh with MFA : enabled
voradmin mfa login
Enables Multifactor Authentication for the current shell, and commands and programs running in that shell, so that it can access MFA-enabled GuardPoints. You must provide a login name and password for Multifactor Authentication enablement.
Syntax
voradmin mfa login
Response
CTE MFA username: ######
CTE MFA password: ######
CTE MFA authentication successful
voradmin mfa ssh enable
Enables the option to use Multifactor Authentication once a user has established an ssh login to the current host. After running this command, user is asked if they want to use Multifactor Authentication. Once logged in successfully, user is asked if they want to enable Multifactor Authentication. Once you enable MFA successfully, CTE Agent can access Multifactor Authentication-enabled GuardPoints.
Syntax
voradmin mfa ssh_enable
voradmin mfa ssh_disable
Disables the option to use Multifactor Authentication once a user has established an ssh login to the current host.
Syntax
voradmin mfa ssh_disable
voradmin mfa set_auth
Set up the authentication method (either OTP or password) to use during CTE multi- factor authentication. If not setup, users have to choose a method during ssh login or voradmin mfa login.
Syntax
voradmin mfa set_auth
Response
Choose authentication method (type p for password, or o for OTP, default o):
MFA authentication method is set.
voradmin mfa set_timeout
You can set Multifactor Authentication so that it times out after a specified period. The timeout value for an MFA session is set in minutes. The default is 0, meaning no timeout.
Note
MFA timeout only applies to new processes. Once a process, like Bash, for example, is MFA-authenticated, it does not time out. Additionally, when a timeout value changes, all MFA-authenticated processes remain authenticated. The timeout change does not affect them.
Syntax
voradmin mfa set_timeout <minutes>
Example 1
voradmin mfa set_timeout 5
Response
MFA session will expire after 5 minute(s).
Example 2
voradmin mfa set_timeout 0
Response
Disabled MFA session timeout.
