Blame
|
1 | # Logging in |
||||||
| 2 | ||||||||
|
3 | ## Interactive Login in CMS with 2FA |
||||||
|
4 | |||||||
|
5 | After enrolling a TOTP token with the procedure from [[2FA Enrolling|Main/2FA/Enrolling]], it is quite simple to use the One-Time Password (OTP) to login via SSH remotely. |
||||||
|
6 | |||||||
| 7 | You may want to have the Authenticator app already open to the token you enrolled, before beginning the SSH session, so that the session doesn't timeout before you are able to enter the code. |
|||||||
|
8 | |||||||
| 9 | ### Logging In |
|||||||
|
10 | |||||||
| 11 | For comparison, your SSH login session without 2FA would appear similar to: |
|||||||
|
12 | ``` |
||||||
| 13 | leblancd @ cadence > ssh leblancd@cmsloginmachine |
|||||||
|
14 | Password: |
||||||
| 15 | Last login: Mon Oct 31 12:37:01 2022 |
|||||||
| 16 | Have a lot of fun... |
|||||||
|
17 | leblancd @ cmsloginmachine > |
||||||
| 18 | ``` |
|||||||
|
19 | |||||||
| 20 | In an SSH session with 2FA in CMS, it looks similar to this: |
|||||||
|
21 | ``` |
||||||
| 22 | leblancd @ cadence > ssh leblancd@cmsloginmachine |
|||||||
|
23 | Password: |
||||||
| 24 | OTP_Token: |
|||||||
| 25 | Last login: Mon Oct 31 12:37:27 2022 |
|||||||
| 26 | Have a lot of fun... |
|||||||
|
27 | leblancd @ cmsloginmachine > |
||||||
| 28 | ``` |
|||||||
| 29 | ||||||||
| 30 | The obvious difference being the `OTP_Token` prompt where you would enter your code provided by your phone's (Google) Authenticator within the lifetime of the code, and within the timeout of your SSH session. |
|||||||
|
31 | |||||||
|
32 | ### If you have a PIN connected to your token |
||||||
|
33 | |||||||
|
34 | If you have elected to set a **PIN** on your TOTP token when you enrolled, your PIN is combined with the 6 digit code provided by your phone's (Google) Authenticator. |
||||||
|
35 | |||||||
|
36 | ***PIN + 6 digit OTP*** |
||||||
|
37 | |||||||
| 38 | *For example*, your phone's Authenticator app refreshes the OTP code every 30 seconds, so if: |
|||||||
|
39 | - your PIN is `007121` |
||||||
|
40 | - in a 30 secs timeframe, your Authenticator app code is `998 001` |
||||||
|
41 | |||||||
|
42 | Then, at the `OTP_Token` prompt, \ |
||||||
|
43 | you would enter: `007121998001` |
||||||