MFA Authentication Error(s) #9915
-
|
I have a distributed grid running here at my company and have chosen to enable MFA for both the super user and our service analyst account per our cybersec compliance req's. As of today, MFA codes aren't unlocking either account. No pw's were changed, no updates were pushed; seemingly random that this happened. Hoping that someone is able to point me in the right direction to address this issue and unlock my accounts while resurrecting our MFA capabilities for SOC. MFA has worked seamlessly for months, up until today. Thanks! -Brian |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
You can remove the MFA requirement from an account by resetting the password with so-user -- try that on one of the affected accounts, then re-enable it and see if it works properly with a new TOTP seed. |
Beta Was this translation helpful? Give feedback.
-
|
Also, make sure that your Manager is properly syncing its system time with an NTP server, if there's clock drift that can break MFA. |
Beta Was this translation helpful? Give feedback.
-
|
Got it, I'll make an update once I return from our server room. Our NTP servers are configured to use NIST.gov time servers, it's possible there is a misconfiguration that triggered the breakage. Thank you Matt! |
Beta Was this translation helpful? Give feedback.
-
|
System clock synchronization was disabled along with NTP service. MFA is back to its old glory, thanks again. |
Beta Was this translation helpful? Give feedback.
You can remove the MFA requirement from an account by resetting the password with so-user -- try that on one of the affected accounts, then re-enable it and see if it works properly with a new TOTP seed.
https://docs.securityonion.net/en/2.3/mfa.html#mfa