1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[FreddysHouse] Two-factor Authentication 1.3.3

Add two-factor authentication to your community.

  1. SheepCow
    Compatible XF Versions:
    • 1.2
    • 1.3
    License:
    Creative Commons Attribution 3.0 Unported (CC BY 3.0), GNU General Public License and MIT license
    Visible Branding:
    No
    This add-on provides XenForo with two-factor authentication using Google's Authenticator app or Yubico YubiKeys.

    The idea behind multi-factor authentication is that you don't rely on just a password to login - instead you require (at least) two of these:
    • Something the user knows (their password).
    • Something the user has (a YubiKey, the Google Authenticator app on their smartphone).
    • Something the user is (a fingerprint, not used in this add-on).
    If a hacker is able to gain access to the user's password (e.g. a bad person installs a key logger on the user's computer) they are still not able to log in without physical access to the two-factor device.

    I recommend also installing [FreddysHouse] Logger, this add-on will log useful information only if that add-on is installed.

    The add-on has the following features:
    • Supports Google Authenticator time-based keys.
    • Supports Yubico YubiKeys.
    • Controlled by permissions.
    • Trophy criteria for users that are using two-factor authentication.
    • Provides detailed logging for admins (if [FreddysHouse] Logger is installed).
    • Provides additional security for your community & also protects your admin control panel.
    • Supports lost keys (works in the same way as a lost password, emails the user for validation and disables two-factor authentication for the user if they click a link in the email).
    Installation

    Upload the contents of the upload directory to your XenForo directory. Install the add-on XML using the control panel.

    Once installed, go to the 'Home' tab, then click 'Install Method' from the 'Two-factor Authentication' section of the menu (if you cannot see the 'Two-factor Authentication' section please give yourself the 'Manage two-factor authentication' admin permission).

    Select the XML file of the method you wish to install (e.g. twofactor-GoogleAuthenticator.xml for Google Authenticator). You can repeat this to install different methods.

    Once you've added a method you should then configure the permissions. There are two permissions you can configure:

    • Use two-factor authentication. This lets you control which users are able to use two-factor authentication.
    • Maximum two-factor keys. Configure how many keys a user can have.
    Yubico Yubikey authentication requires an API key in order to communicate with the Yubico authentication servers. You can get an API key from them here(you need to own a YubiKey to generate an API key).

    Usage

    A special two-factor section has been added to the 'Your Account' section of XenForo. From here users can view, add and remove two-factor authentication keys.

    This add-on uses jQuery.qrcode by Lars Jung.

    Funded by and developed for FreddysHouse (http://www.freddyshouse.com).
    Related Resources:
    This add-on uses [FreddysHouse] Logger for logging.

    Images

    1. account_twofactor_2.png
    2. account_twofactor.png
    3. add_google_authenticator.png
    4. add_yubico_yubikey.png
    5. admin_login_twofactor.png
    6. admin_login.png
    7. admin_twofactor_list.png
    8. admin_twofactor_yubico_yubikey_options.png
    9. bad_twofactor_code.png
    10. entering_twofactor_code.png
    11. twofactor_login_2.png
    12. user_menu.png
    SchmitzIT, t0fx, lasertits and 6 others like this.

Recent Reviews

  1. pipibunny
    pipibunny
    5/5,
    Version: 1.3.2
    Awesome. It's great to security for account
  2. Tracy Perry
    Tracy Perry
    5/5,
    Version: 1.3.2
    Want security? Then this is the add-on for you. Works for both the ACP and site itself.
  3. kontrabass
    kontrabass
    5/5,
    Version: 1.3.2
    Awesome, requiring all my mods and admins to use 2-factor.
  4. Shiro
    Shiro
    4/5,
    Version: 1.3.1
    Great additional layer of security. Would rate five stars if you could require two-factor authentication even if Facebook login is enabled.
  5. MattW
    MattW
    5/5,
    Version: 1.3.0
    Great add-on for that extra layer of security
  6. sonnb
    sonnb
    5/5,
    Version: 1.2.8
    Awesome
  7. Andy.N
    Andy.N
    5/5,
    Version: 1.1.2
    Great addon and it just works as it should. Highly recommended for admin of all sites.
  8. Mouth
    Mouth
    5/5,
    Version: 1.1.2
    Terrific
  9. AlexT
    AlexT
    5/5,
    Version: 1.1.2
    Great idea!
  10. Anthony Parsons
    Anthony Parsons
    5/5,
    Version: 1.1.2
    This is a very clever little system. Took me a few minutes to work out the Google Authenticator app... but otherwise, extremely clever to further login security.