Identity authentication on O2 (2FA and MFA)

This article is written for HMS Researchers as guidance for identity verification on O2. Identity verification consists of both two-factor authentication (such as Duo Mobile) and multi-factor authentication (such as Okta).

Note - These instructions only apply to the Duo interface. Instructions will be updated to incorporate Okta shortly.

Overview

To sign in to an O2 account from outside the HMS network, you must have set up two-factor authentication for your HMS account on your devices. 

• Set up Okta Verify for your HMS account (recommended)
• Set up Duo Mobile for your HMS account - If you currently use Duo Mobile for authentication, consider setting up Okta Verify as the University is transitioning from Duo to Okta for identity verification.

Once you have enrolled in either Okta or Duo, sign in to O2 (o2.hms.harvard.edu) using the SSH application. 

Command Line Tool (SFTP/SCP/etc.) and Graphical Tool (Filezilla, WinSCP) logins

By default, non-interactive commands like scp/sftp/rsync or applications like FileZilla/WinSCP/MobiKwik , etc., will not prompt for a choice between "push | call | sms" and require a default authentication method of "push" or "call" to be set up.

If this is not set, the command/application will simply hang forever or timeout after a few seconds. Review the next section for directions on setting up a default authentication method.

For examples and tips on using these tools with 2FA, review our FAQ.

Set default DUO Method using DUO_PASSCODE environment variable

You can set up a default DUO setting by either using O2 or using secure.med.harvard.edu.

Using O2

Note - By choosing this method, you will not be prompted for regular ssh commands. If you simply want auto-push for non-interactive commands, choose the "using secure.med.harvard.edu" method in the next section.

• to be set on your o2 cluster .bashrc or .bash_profile 
• values: phone, push, sms, sms1, phone1, push1, sms2, push2, phone2.
• If you set the DUO_PASSCODE variable, you will not be prompted for any type of login, such as SSH or SCP/sftp/rsync.
• It is not recommended to use sms with the DUO_PASSCODE variable because you won't be given a prompt to enter sms code, so the login attempt will fail.

Example:

Using secure.med.harvard.edu

Note - By choosing this method, you will still be prompted for regular ssh commands. If you simply want auto-push for ssh commands, choose the "using O2" method in the previous section.

1. Sign in to secure.med.harvard.edu using any browser of your choice.
   
   
2. Enter your HMS account ID and password.
   
   
3. When prompted to select a Duo Push, select Cancel at the bottom of the prompt so that you are not redirected.
   
   
   
   
4. Next, select My Settings & Devices on the left-hand sidebar. Select your default device method, then select Save.
   
    

The next time you do scp/sftp/any non-interactive commands, you will receive a default prompt on your default chosen method.

For Windows Users

To set up your DUO_PASSCODE environment variable, review the How to set the path and environment variables in Windows article. This may require administrator access on your local machine.

If PuTTY is your primary method of connection to O2, this may be a good time for you to transition away from it. We have been recommending built-in terminal emulator applications such as MobaXterm (or for more savvy Windows 10 users, Windows Subsystem for Linux). The reason for this is that setting the environment variable (DUO_PASSCODE) is somewhat involved on Windows as opposed to on OS X or other *nix systems due to there not being easy access to a terminal (and cmd.exe and powershell.exe are not suitable replacements most of the time).

Applications such as MobaXterm superimpose a *nix-like terminal over your Windows installation, and you can navigate your system much like you would navigate O2. Once you have one of these types of applications set up, you can follow the above example verbatim instead of having to do complex menu navigation to accomplish the equivalent result.

MobaXterm also has a built-in X server, so you no longer need a separate program running to perform X11 forwarding (e.g. Xming), as well as a built in ftp browser, so you don't need programs like Filezilla or WinSCP either. We recommend any of the following over PuTTY:

• Install MobaXterm (easiest)
• Install Windows Subsystem for Linux (WSL)
• Install Cygwin

Note - WSL and Cygwin require some level of user competence to configure, so if that is not of interest, we recommend MobaXterm as the drop-in replacement.

If you experience any trouble with using two-factor authentication, contact the HMS Research Computing at rchelp@hms.harvard.edu or review the troubleshooting O2 two-factor authentication guide.