Enabling multi-factor authentication

AegisOne supports time-based one-time password (TOTP) multi-factor authentication for operator accounts, compatible with any standard authenticator application. Given that a console login can reach a shell on every managed endpoint, treat MFA as mandatory rather than optional for anyone with operator access.

To enrol, open your profile and start MFA setup. The platform returns a secret and a QR code. Scan it with your authenticator, then complete verification by entering a generated code. Enrolment is not active until that verification succeeds — this is deliberate, because it proves the authenticator was configured correctly before the account starts depending on it.

# Enrolment via the API, if you are scripting operator onboarding
curl -X POST https://<your-console-host>/api/mfa/setup \
  -H "Authorization: Bearer $AEGISONE_TOKEN"

# Then confirm with a code from the authenticator
curl -X POST https://<your-console-host>/api/mfa/verify \
  -H "Authorization: Bearer $AEGISONE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code":"123456"}'

Codes are time-based, so a device whose clock has drifted will generate codes that are rejected even though the secret is correct. If verification fails repeatedly on a freshly enrolled device, check the device clock before assuming the enrolment is broken.

If an operator loses their authenticator device, an administrator disables MFA on that account so the operator can log in and re-enrol. Confirm the request through a channel other than the one it arrived on. A message asking for MFA to be removed is exactly what an attacker who has obtained a password would send, and it is the single most reliably successful step in a console compromise.

Login attempts are recorded whether or not they succeed. A cluster of failures against one account, or a spread of single failures across many accounts, is worth looking at even when none of them succeeded.