Skip to main content

Configure Local 2FA with Passwords

Configuring Local Privileged Account for logging via Password​

Local privileged accounts can have 2FA enabled, which uses an SSH key or password as the first factor and an approval push as the second factor. After the password is accepted, AuthNull sends a push through your organisation's MFA provider (Settings → MFA Provider: AuthNull Authenticator, Duo Security or Okta Verify). When it is approved, the user is logged in to the endpoint; when it is denied or not answered, the login is refused.

For AuthNull Authenticator, each person who logs in needs a registered phone: Users → row ⋯ → Register device.

This page covers passwords as the first factor. For SSH keys, see Local privilege 2FA with SSH Keys.

Configuring AuthNull's PAM Module for logging in via Password​

  1. Install the AuthNull agent and the AuthNull PAM module on the endpoint as described in Agent based MFA for Linux (Part 1 and Part 2).

  2. For Password authentication, make sure /etc/pam.d/common-auth runs the password check first and the AuthNull module after it, so that the push is the second factor.

  3. Now login to the VM using su

    su username

    i. Please enter the password for user.

    ii. The second factor starts: approve the push on your phone. Check /var/log/auth.log for details.

    iii. Once the push is approved, the user is logged in.

    iv. If the push is denied or expires, the authentication is denied.