Tutorial: Turn On TOTP Multi-Factor Authentication⁠

• A TOTP MFA application such as Google Authenticator, Microsoft Authenticator, Yubikey Authenticator, Gnome Authenticator, Free OTP, etc. There are also standalone hardware devices that support this and work with Access Server, such as the Protectimus Slim NFC token.

• An installed Access Server.

• Supported authentication methods: local, PAM, LDAP, and RADIUS.

1. Sign in to the Admin Web UI.

2. Click Authentication.

3. Set Require MFA to On from the General Settings tab.

4. Slick Save and Restart.

5. Instruct users to sign in on the Client Web UI to enroll:

   1. Sign in to the Client Web UI.

   2. The next screen displays the MFA shared key in QR code and plaintext.

   3. Scan the QR code or enter the key manually into the TOTP app or device.

   4. Enter the six-digit one-time password provided by the TOTP app or device.

   5. Click Confirm Code.

1. Sign in to the Admin Web UI.

2. Click Groups.

3. Click on the desired group.

4. Set Require MFA to Enabled under Authentication on the Group Settings tab.

5. Click Save and Restart.

6. Instruct users to sign in on the Client Web UI to enroll:

   1. Sign in to the Client Web UI.

   2. The next screen displays the MFA shared key in QR code and plaintext.

   3. Scan the QR code or enter the key manually into the TOTP app or device.

   4. Enter the six-digit one-time password provided by the TOTP app or device.

   5. Click Confirm Code.

1. Sign in to the Admin Web UI.

2. Click Users.

3. Click on the desired user.

4. Set Require MFA to Enabled under Authentication on the User Settings tab.

5. Click Save and Restart.

6. Instruct users to sign in on the Client Web UI to enroll:

   1. Sign in to the Client Web UI.

   2. The next screen displays the MFA shared key in QR code and plaintext.

   3. Scan the QR code or enter the key manually into the TOTP app or device.

   4. Enter the six-digit one-time password provided by the TOTP app or device.

   5. Click Confirm Code.

Server-locked and user-locked profiles both adhere to the requirement for multi-factor authentication. However, by default, auto-login profiles don’t adhere to this requirement. Typically, unattended devices—such as servers in data centers establishing connections automatically—use auto-login profiles.

To enable MFA on an auto-login profile:

1. Create a user with auto-login privileges.

2. Install the auto-login profile on the VPN client.

3. Ensure the VPN client is a modern VPN client such as OpenVPN Connect v3.3 or newer.

4. Turn on MFA globally, for the group, or for the user.

5. Connect to the Access Server console and get root privileges and run the following commands to set the auto-login parameter to true:

   sacli --user <USER_OR_GROUP> --key "prop_google_auth_autologin" --value "true" UserPropPut
   sacli start

   • The user account must now enroll in MFA and comply with the TOTP MFA requirement.

If you are using a post-auth script to enhance or replace your authentication process in the Access Server, you can't implement MFA in the post-auth script alongside Access Server's built-in TOTP MFA function. You have to choose to use either the built-in MFA method or implement one yourself in the post-auth script.

Access Server's built-in TOTP MFA function doesn't support users authenticating via SAML. To include MFA with SAML authentication, you must implement this with the IdP or another option such as DUO.