Teleport without 2FA ( two factor authentication )

[kalhori124]

Hi,

I want to have Teleport without 2FA on the Intranet without Internet access. so Teleport server does not have Internet access and we do not have UFA right now.

How can I disable 2FA ?

Thanks.

[webvictim]

EDIT: This is no longer possible with Teleport version 16 and above - MFA must now be used for additional security.

For older versions of Teleport, set this in /etc/teleport.yaml and restart your Teleport server:

auth_service:
  authentication:
    second_factor: off

[PavelNiedoba]

it is nice, that i can remove it from all users, can i remove it from single user too ?

[webvictim]

No, this is a cluster-wide setting.

[dellarte]

Hi !
Not working.

version: v3
teleport:
  nodename: **********
  data_dir: /var/lib/teleport
  log:
    output: stderr
    severity: INFO
    format:
      output: text
  ca_pin: ""
  diag_addr: ""
auth_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3025
  cluster_name: teleport.*************
  proxy_listener_mode: multiplex
  authentication:
    second_factor: off
ssh_service:
  enabled: "yes"
proxy_service:
  enabled: "yes"
  https_keypairs: []
  https_keypairs_reload_interval: 0s
  acme: {}

then, after a teleport start :

ERROR: initialization failed

Teleport requires second factor authentication for local users.
The auth_service configuration should be updated to enable it.

auth_service:
  authentication:
    second_factor: on
    webauthn:
      rp_id: example.com

For more information:
- https://goteleport.com/docs/access-controls/guides/webauthn/

                cannot disable multi-factor authentication

version:16.0.4

[webvictim]

This is a recent breaking change in version 16 - see the changelog: https://goteleport.com/docs/changelog/#multi-factor-authentication-is-now-required-for-local-users

If you use version 15 or earlier, you will still be able to disable MFA. We don't recommend that you do, however, as it is far less secure.

[dariussus]

I had just begun to try out Teleport on my local network, and I was pretty excited about getting it up and running. However, the excitement has now vanished, as I tried to turn off 2FA for my test setup and found this discussion.

If you decide that you are more intelligent than your customers and force them to do something, then I wish you good luck with your software project! I will stop evaluating Teleport now and will recommend everyone to not use it.

[dellarte]

@dariussus I also tried to test it offline and bypassed the MFA (phone) with a browser add-ons which act as 2fa client. Give it a try.

I decided to not continue with Teleport because it doesn't not provide active directory login