I have some q=question regarding Secure Login the User Management account access controls for community portal we need to ensure the administrative/privileged accounts require 1. Private Network and 2. Strong Authentication (Basic auth + MFA) access controls in-place.

[image] Jaskaran: Strong Authentication (Basic auth + MFA) access controls in-place That’s built in. Search site settings. [image] Jaskaran: Private Network I’m not aware of a way to do that. It’ll take a plugin. There’s a geofencing plugin that could be a start. Happy to help with that or you can ask in #marketplace.

You can restrict admin logins to specific IP addresses if that helps? use admin ip allowlist + allowing them in the Screened IPs

What happends when admin’s IP changes?

Wow! I didn’t know there was an admin allow-list! I’d guess it’ll take network addresses so you can give it a whole class C or whatever. [image] Jakke Flemming: What happends when admin’s IP changes? They’d need another admin to update the setting. But I would assume that this would be used when the admin uses a vpn to the company network, so if the address changed, it would mean he was no longer allowed to be an admin.

That is kind of my point. Limiting IP can and will be a potentially hazardous setup if an admin works outside the business world :thinking: If such a security measure is needed and there is only one admin and the admin is using an IP that can and will change, then using Varnish or a similar frontend for Discourse is a safer solution (unless the shell gives a backdoor). (Oh dear how much proofreading fixes my text :flushed_face: :woozy_face:)

Did you take a look at the topics I linked in Two-factor authentication method for additional security during login - #4 by Moin ? The video was very helpful for me. You can also set up two-factor authentication for a test account to try without enabling the setting which forces staff to enable it. When you enable the setting, you have to set it up for your account if you haven’t done so before; you can’t do anything else on your site until you’ve done that, not even disable the setting.

Secure login

Product Support

Jaskaran (Jaskaran) September 24, 2024, 12:05pm 7

Hi I want to understand how enforce second factor is working . If i enable it for staff what we need to do extra for second authentiction

Topic		Replies	Views
"You can't login from that IP address" Product Support	28	15555	December 9, 2022
Admin Account Security Best Practices? Product Support	6	827	March 1, 2021
Limit login to staff only? Product Support	7	1211	August 27, 2023
User is saying their account is hacked Product Support	5	750	June 20, 2020
Disable /u/admin-login Product Support login	9	913	March 20, 2024

Secure login

Related topics