Two-Factor Authentication on SuperMUC-NG
1. Status
Two-Factor Authentication is enabled on SuperMUC-NG!
2. Overview
In view of increasing security risks, we are forced to strengthen the security measures. In order to improve the security of our HPC systems, we have changed the authentication procedure on all login nodes to two-factor authentication (2FA) as of July 11, 2023. For all users SuperMUC-NG is only accessible with 2FA.
In order to use 2FA on SuperMUC-NG, you need to configure it in advance! That procedure comprises two steps: Registration of the token(s) at LRZ SIM-MFA portal and configuration on your local device. A "token" is a piece of hardware or software that serves as a second factor in authentication. Tokens for 2-factor authentication must first be registered on the SIM-MFA web portal at LRZ before they can be used for authentication on a LRZ service. 2FA will not replace the conventional ssh method with password or public key. Rather, it will ask you for a second factor on top of the conventional login credentials. This documentation will guide you through these steps.
The introduction of two-factor authentication will have impact on the procedure of accessing SuperMUC-NG. Automatic (data transfer) workflows between your local computer and the login node may no longer work! Please Contact Us and report issues.
3. Problems? Questions? Contact Us Here!
If you have any questions or problems regarding 2FA on SuperMUC-NG login nodes, we kindly ask you to...
- Check the FAQ section for possible solutions.
- Contact us via Servicedesk. After login to the Selfservice portal, just choose "Incident: I have login problems" from the drop-down list and continue.
4. Step-by-Step Instruction of 2FA Configuration
4.1. Recommended Procedure
Software tokens on mobile devices are most popular.
Please consider: The smartphone may be broken, you may loose it or the 2FA app may no longer work and has to be reinstalled. Then, you have locked yourself out of LRZ services! That is, you are no longer able to login to SuperMUC-NG or to the LRZ SIM-MFA web portal to manage your tokens.
We strongly recommend to create multiple tokens! For example, create a software token on your mobile device and an additional recovery token as fallback solution. Please read here for details!
4.2. Supported 2FA methods on SuperMUC-NG
Numerous authentication methods are available. You may choose any token available in the SIM-MFA portal. However, please consider that we only offer support concerning configuration and usage for the following list of tokens!
Please note! We recommend to create multiple tokens, e.g. a token for regular login procedures and a recovery token as fallback solution!
|
Recommended Tokens for Login Procedures |
|
TOTP token: An authenticator app on your mobile device continuously generates new Time-based One Time Passwords, which can be used as a second factor at ssh login to SuperMUC-NG. |
|
|
Hardware token YubiKey: This is an individually configured USB-Key for each user. When asked by the ssh login, touching this hardware token will provide the second factor. The login procedure completes.
|
|
|
Recommended Recovery Token |
|
TAN list: The SIM-MFA portal will generate a list of 100 TANs which you need to download. We recommend to print it on a sheet of paper. You may use this list as recovery token. Each TAN can only be used once! |
|
Additional Token (limited support) |
|
PUSH token: Your ssh login to the SuperMUC-NG triggers a notification sent to your mobile device. By accepting the notification the second factor will be sent back to the LRZ server and the login procedure completes automatically. Due to dependency on third-party software (notification service), we provide limited support for this token! |
4.3. Configuration of 2FA Method
-
Regardless of the 2FA method chosen, you have to register/login in the SIM-MFA web portal in order to create and configure 2FA tokens! Click here to login to the SIM-MFA web portal.
Please login to the SIM-MFA portal with exactly the same user ID (account) that you will need to access SuperMUC-NG, i. e. the user ID with SuperMUC-NG permission! Do you have multiple user IDs? Then, you must configure 2FA for each user ID seperately! -
According to our policy, the use of a second device (e. g. your mobile device, a Yubikey or a TAN list) for provision of the second factor is mandatory!
Select one of the following methods to proceed with the configuration of the 2FA token of your choice in SIM-MFA portal as well as on your local device.
Please carefully read the instructions and recommendations!
5. Login to SuperMUC-NG
|
Step 1: Login via SSH |
||
|
You may use SSH password authentication or SSH public-key authentication. All login rules via Secure Shell on LRZ HPC Systems still apply.
Login via password authentication
$ ssh userID@skx.supermuc.lrz.de Password:
Explanation
<-- Enter ssh command! <-- Enter the password of your account here!
Login via public-key authentication
$ ssh -p 2222 userID@skx.supermuc.lrz.de
Explanation
<-- Enter ssh command! |
||
| Step 2: Apply second factor | ||
|
2FA Prompt
Token_Response:
Explanation
<-- Apply second factor here using the 2FA method you have chosen (TOTP, PUSH, YubiKey, TAN)! |
||
|
|
|
|
NOTE Timing is important! Please do not enter an OTP which is no longer valid! |
|
|
|
After logging in, you are in your HOME directory and can work on SuperMUC-NG as usual. |
||