FAQs
Basics
What is AuthNull?
AuthNull adds multi-factor authentication and policy-based access control to the systems your users sign in to. When a sign-in needs MFA, AuthNull sends a push to the user's phone through your MFA provider, and the sign-in completes only after the push is approved.
What can AuthNull protect?
AuthNull has four products. Switch between them with Switch product in the admin console:
| Product | Protects | Guide |
|---|---|---|
| Identity | Windows and Active Directory sign-ins | Identity MFA |
| Database | PostgreSQL and MySQL logins | Database MFA |
| RADIUS | VPNs and network devices | RADIUS MFA |
| PAM | Privileged SSH access to servers | PAM MFA |
How do I get started?
Create your organization, choose an MFA provider, add your users, then set up the product you want to protect. See Getting Started.
Can I run AuthNull in my own data center?
Yes. AuthNull runs as a Docker Compose stack on a single Linux server. See On-Prem Setup.
MFA
Which MFA providers are supported?
Duo Security and Okta Verify. One provider is active per organization and is used for every product. See MFA Providers.
Is there an AuthNull authenticator app?
The AuthNull Authenticator is coming soon. Until it is released, use Duo Security or Okta Verify.
How does AuthNull know which Duo or Okta user to push to?
By email address. A user's email in AuthNull must match their Duo or Okta account.
Who receives the push for a database or server session?
The AuthNull user who opened the connection - not the database or server account they connect as.
How do users sign in to the AuthNull console?
With a password plus a second factor: an authenticator app code (TOTP), a passkey, or a push. See End-User Console Access.
I have a new phone. How do I keep getting pushes?
Move Duo Mobile or Okta Verify to the new phone the way your Duo or Okta organization allows - usually by re-activating the app there. AuthNull pushes to whichever phone is enrolled with your provider.
Users
How do I add users?
Add them one at a time or import them under Users → Add Users, or sync them from Active Directory or EntraID under Identity Sources in the Identity product. See Adding Users.
How do users set their password?
Each new user receives an email titled Set up your Authnull account with a link to choose a password. The link works once and expires after 7 days.
I forgot my password.
Use Forgot password? on the sign-in page. If you set up an authenticator app code and lost the app, use one of your saved recovery codes.
Policies
How do policies work?
Every protected sign-in is matched against a policy, which decides who may sign in, to what, and whether a push is required first. Each product has its own Policies screen. See Policy-Based Access Control.
What actions can a policy take?
Allow (no MFA), MFA required (a push must be approved), or Deny. Database policies call these Allow, Require MFA, and Block.
How do I roll out policies without blocking people?
Start the tenant in Audit mode (Settings → Tenant Configuration → Authentication policy). AuthNull records sign-ins and creates policies from them. Move to Policy to simulate enforcement, then to Live mode to enforce.
Can I grant temporary admin rights on a server?
Yes. A PAM policy can grant full sudo or specific commands for 5 to 720 minutes, only to sessions approved with MFA. See Sudo in Policies.
Troubleshooting
A user gets no push.
Check that the MFA provider shows Active, the user is enrolled in Duo Mobile or Okta Verify with a matching email, and the sign-in matched a policy that requires MFA. See Troubleshooting.
Where can I see why a sign-in was allowed or denied?
In the product's Logs (Identity and RADIUS) or Access Logs (PAM). Each entry shows the decision and the MFA outcome. For databases, see Database MFA Troubleshooting.
A sign-in is blocked unexpectedly.
The tenant may be in Live mode, where anything without an allowing policy is blocked. Check Settings → Tenant Configuration → Authentication policy.