Administrator Tasks for Multifactor Authentication

Note

Root user privilege is required for all commands except for logging in.

Voradmin Commands

The Multifactor Authentication command group contains the following commands:

Syntax voradmin mfa [ config | login | ssh_enable | ssh_disable | set_auth | set_timeout]

voradmin mfa config

Displays configuration information.

Syntax

voradmin mfa config

Response

Host Mfa Enable is not set.
MFA enabled guardpath(s) (Number of paths: 2):
        /home/work1/gp_mfa
        /home/work1/gp_mfa
MFA Exempt-List: (Number of entries: 1)
        uid:1001,       gid:1001,       user: "malfoy", group: "wizards", domain(s): ""
OIDC configuration:
        client-id : cte-client-malfoy-1
                url : https://www.keycloak-sj1.org:8443/realms/cte-linux/.well-known/openid-configuration
ssh with MFA : enabled

voradmin mfa login

Enables Multifactor Authentication for the current shell, and commands and programs running in that shell, so that it can access MFA-enabled GuardPoints. You must provide a login name and password for Multifactor Authentication enablement.

Syntax

voradmin mfa login

Response

CTE MFA username: ######
CTE MFA password: ######
CTE MFA authentication successful

voradmin mfa ssh enable

Enables the option to use Multifactor Authentication once a user has established an ssh login to the current host. After running this command, user is asked if they want to use Multifactor Authentication. Once logged in successfully, user is asked if they want to enable Multifactor Authentication. Once you enable MFA successfully, CTE Agent can access Multifactor Authentication-enabled GuardPoints.

Syntax

voradmin mfa ssh_enable

voradmin mfa ssh_disable

Disables the option to use Multifactor Authentication once a user has established an ssh login to the current host.

Syntax

voradmin mfa ssh_disable

voradmin mfa set_auth

Set up the authentication method (either OTP or password) to use during CTE multi- factor authentication. If not setup, users have to choose a method during ssh login or voradmin mfa login.

Syntax

voradmin mfa set_auth

Response

Choose authentication method (type p for password, or o for OTP, default o):: o

MFA authentication method is set.

voradmin mfa set_timeout

You can set Multifactor Authentication so that it times out after a specified period. The timeout value for an MFA session is set in minutes. The default is 0, meaning no timeout.

Note

MFA timeout only applies to new processes. Once a process, like Bash, for example, is MFA-authenticated, it does not time out. Additionally, when a timeout value changes, all MFA-authenticated processes remain authenticated. The timeout change does not affect them.

Syntax

voradmin mfa set_timeout <minutes>

Example 1

voradmin mfa set_timeout 5

Response

MFA session will expire after 5 minute(s).

Example 2

voradmin mfa set_timeout 0

Response

Disabled MFA session timeout.