FR: connect to servers with 2FA enabled

[adv0r]

trafficstars

Solo staker here, followed good practices (as suggested on CoinCashew btw) and enabled Google Authenticator 2FA to connect via ssh: libpam-google-authenticator

[daGscheid]

We hopefully finally tackle this, because it would be nice to have.

This tutorial gives a basic overview of how to setup 2FA with a remote server. https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-18-04

To support this option in Stereum we were thinking about the following flow:

The Google will be integrated as an additional service installable service:

Once installed the modal will be available on the top, revealing, when clicked, the following options:

The options presented here are:

1. To setup a completly new 2FA
2. To import an existing back-up of your secret key via the .google-authenticator file

When generating a new 2FA, before the key is able to be generated, the user has to decide if they want to use a time based token (which is recommended)

Clicking the "Generate Key" button leads to the next step

After generating the new secret key, the user continues to the modal above.

Here the user should back up his secret key (which can be later used for importing it in the first step).

Below it the user is able to conenct his Google Authenticator via the QR & should write down the all secrets presented. This includes a secret key, a verification code & the scartch codes necessary to regain the ability to authenticate themselves

Before the user can continue he has to check the "Confirm that you sucessfully set up the Google Authenticator!" box to make sure he doesn't lock himself out of his own remote server (lol)

Clicking the button, writes the key and options to the .google_authenticator file. If the user says closes it, the program quits and nothing is written, which means the authenticator won’t work

Now having actually setup the 2FA, the user is able to modify some options. Here they are also recommended options, which are shown above. Having configured this, the user is now completly finished with the setup process

From there on onwards, the modal above is what greeets the user whenever he click the symbol in the header.

Here the user is again presented with two options:

1. Change the configuration (as in the step before)

2. OR delete the 2FA authentification, confirming it by clicking the button again.

---

After this setup, as soon as the user logs in...

... they will be presented with following modal:

Where they will have to enter the OTP generated by the Authenticator

[daGscheid]

Having discussed with @PatrickRL. Will make slight adaptions to the setup process. Instead of having to add a service we decided to just make it part of Stereum.

2FA will join as an extra tab in the server management

Having to save the backup:

Having to confirm that the setup was sucessfully:

[adv0r]

niceeeeeeee