>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2239973. --> Reported by: [greggles](https://www.drupal.org/user/36762) >>> <p>Two factor authentication is a good idea. There are several ways to do it, but <a href="https://drupal.org/project/tfa">tfa</a> 7.x-2.x and <a href="https://drupal.org/project/tfa_basic">tfa_basic</a> 7.x-1.x are probably the best option. They support the industry standard TOTP protocol with Recovery Codes as a backup method (and <a href="https://drupal.org/sandbox/coltrane/2200763">SMS</a> if we want to support that, though it would require some API capable of sending sms which costs a small amount of money). </p> <h2>Testing TFA on Drupal.org</h2> <p>Steps to enable TFA and test on a devdrupal site.</p> <ol> <li>Go to <a href="https://tfa-drupal.redesign.devdrupal.org">https://tfa-drupal.redesign.devdrupal.org</a> and for htauth use drupal:drupal</li> <li>Because passwords are sanitized on stage sites you'll need a one-time login link to get in (ping greggles or coltrane in #drupal or #drupal-contribute to get one)</li> <li>Set a password for your account (different than main drupal.org one)</li> <li>Click the "Security" tab on your account profile</li> <li>Choose to setup two-factor authentication</li> <li>Enter your password</li> <li>Choose application setup</li> <li>Install one of the recommended TFA applications (Google Authenticator, FreeOTP, etc) and scan the QR code or enter the code into your mobile application</li> <li>Once entered your application will generate a 6-digit numeric code that you'll enter back into the TFA form</li> </ol> <p>See comment <a href="https://drupal.org/node/2239973#comment-8851467">#13</a> for further steps and screenshots.</p> <h2>Two factor authentication deployment plan</h2> <ol> <li><del>In settings.local.php set the following conf variables</del> <ul> <li><code>$conf['tfa_basic_secret_key']</code> to the results of <code>openssl rand -base64 32</code></li> <li><code>$conf['tfa_basic_cookie_domain'] = '.drupal.org';</code></li> </ul> </li> <li><del>Update drupalorg_crosssite</del></li> <li><del>Add tfa and tfa_basic modules to the site</del></li> <li><del>Merge &amp; deploy drupalorg's <code>2239973-tfa</code> branch</del></li> <li>Enable the modules and on admin/config/people/tfa choose to enable TFA</li> <li>Set TOTP as the default validation plugin, also enable recovery codes and help plugin</li> <li>Enable login plugin and set the default help text to<br> <blockquote><p>Email <a href="mailto:help@drupal.org">help@drupal.org</a> to reset your access.</p></blockquote> </li> <li>Inform administrators they should set up TFA for their account</li> </ol> <p>Later,</p> <ol> <li>Send emails periodically to people with admin roles that have not set up TFA and encourage them to do so</li> <li>After 60 days, if someone hasn't enabled TFA their admin roles should be revoked (they can be regranted once the person has enabled TFA)</li> <li>Fix any bugs or documentation/usability issues encountered in the initial roll-out period</li> <li>Allow anyone with "community" role to set up TFA</li> </ol> <h2>Tools for Generating TOTP codes</h2> <p>There are multiple free and Free options for creating TOTP codes on a smartphone or laptop. Wiki and discussion about apps on groups.drupal.org at <a href="https://groups.drupal.org/node/438328">https://groups.drupal.org/node/438328</a></p>