Administrator Tasks for Multifactor Authentication

Voradmin Commands

The Multifactor Authentication command group contains the following commands:

Syntax

    # voradmin mfa [ config | login | ssh_enable | ssh_disable | set_auth | set_timeout]

voradmin mfa config

Displays configuration information.

Syntax

    # voradmin mfa config

Response

    Host Mfa Enable is not set.
    MFA enabled guardpath(s) (Number of paths: 2):
            /home/work1/gp_mfa
            /home/work1/gp_mfa
    MFA Exempt-List: (Number of entries: 1)
            uid:1001,       gid:1001,       user: "malfoy", group: "wizards", domain(s): ""
    OIDC configuration:
            client-id : cte-client-malfoy-1
                    url : https://www.keycloak-sj1.org:8443/realms/cte-linux/.well-known/openid-configuration
    ssh with MFA : enabled

voradmin mfa login

Enables Multifactor Authentication for the current shell, and commands and programs running in that shell, so that it can access MFA-enabled GuardPoints. You must provide a login name and password for Multifactor Authentication enablement.

Syntax

    # voradmin mfa login

Response

    CTE MFA username: ######
    CTE MFA password: ######
    CTE MFA authentication successful

voradmin mfa ssh enable

Enables the option to use Multifactor Authentication once a user has established an ssh login to the current host. After running this command, user is asked if they want to use Multifactor Authentication. Once logged in successfully, user is asked if they want to enable Multifactor Authentication. Once you enable MFA successfully, CTE Agent can access Multifactor Authentication-enabled GuardPoints.

Syntax

    # voradmin mfa ssh_enable

voradmin mfa ssh_disable

Disables the option to use Multifactor Authentication once a user has established an ssh login to the current host.

Syntax

    # voradmin mfa ssh_disable

voradmin mfa set_auth

Set up the authentication method (either OTP or password) to use during CTE multi- factor authentication. If not setup, users have to choose a method during ssh login or voradmin mfa login.

Syntax

    # voradmin mfa set_auth

Response

Choose authentication method (type p for password, or o for OTP, default o):: o

MFA authentication method is set.

voradmin mfa set_timeout

Set a timeout value for an MFA session. The timeout value is set in minutes. The default is 0, meaning no timeout.

Syntax

    # voradmin mfa set_timeout <minutes>

Example 1

    # voradmin mfa set_timeout 5

Response

    MFA session will expire after 5 minute(s).

Example 2

    # voradmin mfa set_timeout 0

Response

    Disabled MFA session timeout.