CERN Computer Security Information

Starting with Two-Factor Authentication

"Authentication" is the process where you digitally prove who you are. Usually, your identity is verified when you type in your username and password. As you should never(!) share your password with someone else, only you can provide the correct password to your digital identity.

Instructions regarding 2FA for SSH access can be found below.

At CERN, you have basically one password which is attached to your CERN account and the Single Sign-On portal is the central instance for authentication. Please report to us whenever you are asked for your CERN password outside the Single Sign-On portal portal.

For some services, "just" knowing a password might not be sufficient as passwords get regularly stolen or lost. "Two-Factor Authentication" is an enhanced method that requires not only you knowing something (a password) but also you possessing a physical device (hardware token, phone, ...). The following services are thus requiring "Two-Factor Authentication":

Password authentication is suitable for many users who visit CERN services for their daily tasks (e.g. attending Indico events, accessing the CERN Marketplace). For CERN users who have access to critical systems, however, protecting their account with only a password is not enough since passwords are regularly lost or stolen. This, hence, presents an essential security risk. "Two-Factor Authentication" is an enhanced method that requires not only that you know something (a password) but also that you possess a physical device like a hardware token or a phone with an authentication app. If a CERN user is required to access a critical service, they must enable Two-Factor Authentication for themselves. Once Two-Factor Authentication is enabled it must be used for every login (typically once per day) unless it’s disabled. Users of the following services must enable Two-Factor Authentication for themselves:

  • Critical applications that are used within the CERN Finance Department or in the CERN Computer Security Team;
  • Any remote access gateway used to access the Technical Network;
  • Access to sensitive services used for the internal infrastructure of the CERN IT Department.

This list will increase over time as more services enforce Two-Factor Authentication. Ultimately, any CERN user whose account could be abused to inflict significant damage to CERN should have their account protected using Two-Factor Authentication. Even if you are not accessing one of these critical services you are welcome to enable it for yourself as an additional security measure!

CERN Single Sign-On offers two options for registering a second factor:

  • A One-time-password application running on your smartphone (for example andOTP, FreeOTP Authenticator, Google Authenticator, ...);
  • A WebAuthn token generator, such as a Yubikey or some modern fingerprint readers.

It's essential that your second authentication factor is physically separated from your main working devices. That's why Two-Factor Authentication mechanisms are either physical tokens (e.g. a physical card with a chip, a Yubikey) or an app on your smartphone (e.g. a dedicated banking app, or an app generating one-time passwords / OTP.

Obtaining, managing and dealing with lost 2nd factor

Please consult this ServiceNow Knowledge Base article KB0006587. For more general questions, please consult our FAQ.

"WebAuth" prerequisites on Linux systems

As your web browser needs to interact with the WebAuth token during registration or authentication, it needs to be authorized to do so. Unfortunately, generic support for WebAuth hardware tokens was added only very recently to systemd/udev itself. Some distributions (e.g. Fedora, Ubuntu) have other solutions in place by default, but this is not the case for all distributions yet.

CERN CentOS 7

A package has been added to CERN CentOS 7 (also available in EPEL): u2f-hidraw-policy. You just need to unplug/replug the device into your system after installing it.

2FA for SSH

Two-Factor Authentication also works to protect Linux servers via SSH! If you are a system manager interested to enable it, just include our multifactor Puppet module or check our code on Github.

The same tokens (Time based One Time Passwords, TOTP, using an Authenticator App) and Yubikeys are supported for SSH access. TOTP codes generated by your authenticator app configured on the SSO can be directly used for SSH access as well.

To use your Yubikey(s) for SSH access, you need to register your key on this dedicated website. While CERN-issued Yubikeys can be directly registered, using your private Yubikey for SSH requires custom-configuration and sending the secrets to the CERN Computer Security Team.

Support

A series of questions and their answers are published on this FAQ. For further questions or help, please contact the CERN Service Desk at Service.Desk@cern.ch.