proxmox-mirrors/pve-docs
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-docs synced 2025-05-29 20:37:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

user management: small follow-up rewording/nits for TFA locks

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2023-06-07 17:45:52 +02:00
parent 96a0d13193
commit e253a7876e
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pveum.adoc
View File

@ -580,7 +580,7 @@ https://www.yubico.com/products/services-software/yubicloud/[YubiCloud] or
https://developers.yubico.com/Software_Projects/Yubico_OTP/YubiCloud_Validation_Servers/[host your own verification server]. https://developers.yubico.com/Software_Projects/Yubico_OTP/YubiCloud_Validation_Servers/[host your own verification server].
[[pveum_tfa_lockout]] [[pveum_tfa_lockout]]
Limits and lockout of Two-Factor Authentication Limits and Lockout of Two-Factor Authentication
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A second factor is meant to protect users if their password is somehow leaked A second factor is meant to protect users if their password is somehow leaked
@ -588,14 +588,14 @@ or guessed. However, some factors could still be broken by brute force. For
this reason, users will be locked out after too many failed 2nd factor login this reason, users will be locked out after too many failed 2nd factor login
attempts. attempts.
For TOTP 8 failed attempts will disable the user's TOTP factors. They are For TOTP, 8 failed attempts will disable the user's TOTP factors. They are
unlocked when logging in with a recovery key. If TOTP was the only available unlocked when logging in with a recovery key. If TOTP was the only available
factor, admin intervention is required, and it is highly recommended to require factor, admin intervention is required, and it is highly recommended to require
the user to change their password immediately. the user to change their password immediately.
Since FIDO2/Webauthn and recovery keys are less susceptible to brute force Since FIDO2/Webauthn and recovery keys are less susceptible to brute force
attacks, the limit there is higher, but block all second factors for an hour attacks, the limit there is higher (100 tries), but all second factors are
when exceeded. blocked for an hour when exceeded.
An admin can unlock a user's Two-Factor Authentication at any time via the user An admin can unlock a user's Two-Factor Authentication at any time via the user
list in the UI or the command line: list in the UI or the command line: