Teleport without 2FA ( two factor authentication )

[kalhori124]

Hi,

I want to have Teleport without 2FA on the Intranet without Internet access. so Teleport server does not have Internet access and we do not have UFA right now.

How can I disable 2FA ?

Thanks.

[webvictim]

EDIT: This is no longer possible with Teleport version 16 and above - MFA must now be used for additional security.

For older versions of Teleport, set this in /etc/teleport.yaml and restart your Teleport server:

auth_service:
  authentication:
    second_factor: off

[PavelNiedoba]

it is nice, that i can remove it from all users, can i remove it from single user too ?

[webvictim]

No, this is a cluster-wide setting.

[dellarte]

Hi !
Not working.

version: v3
teleport:
  nodename: **********
  data_dir: /var/lib/teleport
  log:
    output: stderr
    severity: INFO
    format:
      output: text
  ca_pin: ""
  diag_addr: ""
auth_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3025
  cluster_name: teleport.*************
  proxy_listener_mode: multiplex
  authentication:
    second_factor: off
ssh_service:
  enabled: "yes"
proxy_service:
  enabled: "yes"
  https_keypairs: []
  https_keypairs_reload_interval: 0s
  acme: {}

then, after a teleport start :

ERROR: initialization failed

Teleport requires second factor authentication for local users.
The auth_service configuration should be updated to enable it.

auth_service:
  authentication:
    second_factor: on
    webauthn:
      rp_id: example.com

For more information:
- https://goteleport.com/docs/access-controls/guides/webauthn/

                cannot disable multi-factor authentication

version:16.0.4

[dellarte]

@dariussus I also tried to test it offline and bypassed the MFA (phone) with a browser add-ons which act as 2fa client. Give it a try.

I decided to not continue with Teleport because it doesn't not provide active directory login

[laertispappas]

@dariussus @dellarte QQ which solution did you eventually landed on using?

[Atroskelis]

I can confirm that Teleport can be used with Bitwarden/password vault extension by using the passwordless login. Alas i dont think you can do this with Teleport Desktop and the 2FA with phone doesnt work most of the time. Still the reticence to allow simple auth without 2FA is not normal as some if not most users usually have the teleport cluster in a private secure environment and not publicly exposed

[bodleytunes]

Have to say its pretty annoying to be forced to use MFA. I want to be insecure, its my choice lol

[parassjain]

i used to praise teleport, its a really good opensource product, but this is really annoying. i want to disable 2fa. it should be configurable.