To increase general security and reduce the need to age passwords, CMS has implemented a two-factor authentication (hereafter "2FA") method for interactive login. You do not need to set up 2FA for email or web logins or any other CMS service, only to use an SSH client to gain console access to interactive login servers (login.cms.caltech.edu, group login hosts for compute intensive work, etc)

Most likely, your Android or iPhone already has Google Authenticator installed. CMS 2FA will work with Google Authenticator, but for the purposes of this documentation we will assume that you don't have it installed. If you are already familiar with Google Authenticator and know it is installed on your phone, you can skip the first part of the instructions. You can also use privacyIDEA Authenticator.

Download and install Google Authenticator on your cell phone. This is both available via the Google Play store and via the App Store for the iPhone. Simply open the Play Store or the App Store, search for the app, and install it. If you have an objection to Google Authenticator you can also use privacyIDEA Authenticator, but the remainder of this documentation assumes Google Authenticator is the app you are using (instructions are similar for both).

{{Figure

|caption=Google Play Store - Google Authenticator

|align=left

|width=50%


}}

{{Figure

|caption=Google Play Store - PrivacyIDEA Authenticator

|align=left

|width=50%


}}

Log into the [CMS Token Management gateway](https://torii.cms.caltech.edu/), using your CMS credentials.

{{Figure

|caption=Torii Login

|align=left

|width=65%


}}

The first time you log in, you'll see the "Welcome" splash, hit OK

{{Figure

|align=left

|width=50%


}}

If you have never enrolled a token before, and this is your first time logging in here, the system will automatically enroll a token for you.

{{Figure

|caption=Enroll Token

|align=left

|width=75%


}}

Click **Enroll Token**

{{Figure

|caption=QR Code

|align=left

|width=50%


}}

Scan this QR code with your phone, either with your (Google) Authenticator app, or the phone's camera, and it should proceed to add this OTP token to your phone'a authenticator system.

This will create your token and logout.\

Click **Logout** and you'll be logged out.

You may login again, but you have already accomplished everything needed to use your token to SSH remotely!