Multi-Factor Authentication is the practice of adding an extra authentication step - often requiring use of a separate device such as a smartphone. What this means for you is that even if your login credentials are somehow obtained by a third party, they still would not be able to log in without also obtaining your MFA device. Multi-Factor Authentication is essentially to any website owner who values site security.
Logging In with MFA
Setup Instructions
- In the backend, go to My Account in the top right.
- Check the Use Multi-Factor Authentication? checkbox.
- Generate an MFA Secret and scan the generated barcode using Google Authenticator (Android, iPhone).
- Enter two security questions and answers - these will be used when you don't have access to your phone.
- Click Save at the bottom of the form.
Once set up, Google Authenticator will display a continually changing set of 6 digits. When you next log in, you'll need to enter the currently showing number.
For Extra Security
- In the backend, go to Settings - Multi-Factor Authentication
- Check Require MFA for all administrators?
This option will restrict new or existing administrators who haven't yet enabled MFA to the My Account section of admin until they set it up.
-
Guido Krömer
Found the plugin useful on 15 Jan, 2020
Updating from 1.0.3 to 1.0.4 fails when using sqlite, I did this workaround get the plugin working, the update fails hence altering columns in sqlite is not possible.
PRAGMA foreign_keys=off; /* * .schema backend_users */ CREATE TABLE IF NOT EXISTS "backend_users_backup" ( "id" integer not null primary key autoincrement, "first_name" varchar null, "last_name" varchar null, "login" varchar not null, "email" varchar not null, "password" varchar not null, "activation_code" varchar null, "persist_code" varchar null, "reset_password_code" varchar null, "permissions" text null, "is_activated" tinyint(1) not null default '0', "role_id" integer null, "activated_at" datetime null, "last_login" datetime null, "created_at" datetime null, "updated_at" datetime null, "is_superuser" tinyint(1) not null default '0', "deleted_at" datetime null, "mfa_enabled" tinyint(1) not null default '0', "mfa_secret" varchar not null default '', "mfa_persist_code" varchar not null default '', "mfa_question_1" varchar not null default '', "mfa_answer_1" varchar not null default '', "mfa_question_2" varchar not null default '', "mfa_answer_2" varchar not null default ''); /* * Modifyed .schema backend_users */ INSERT INTO backend_users_backup SELECT * FROM backend_users; DROP TABLE backend_users; CREATE TABLE IF NOT EXISTS "backend_users" ( "id" integer not null primary key autoincrement, "first_name" varchar null, "last_name" varchar null, "login" varchar not null, "email" varchar not null, "password" varchar not null, "activation_code" varchar null, "persist_code" varchar null, "reset_password_code" varchar null, "permissions" text null, "is_activated" tinyint(1) not null default '0', "role_id" integer null, "activated_at" datetime null, "last_login" datetime null, "created_at" datetime null, "updated_at" datetime null, "is_superuser" tinyint(1) not null default '0', "deleted_at" datetime null, "mfa_enabled" tinyint(1) null default '0', "mfa_secret" varchar null default '', "mfa_persist_code" varchar null default '', "mfa_question_1" varchar null default '', "mfa_answer_1" varchar null default '', "mfa_question_2" varchar null default '', "mfa_answer_2" varchar null default ''); CREATE UNIQUE INDEX "login_unique" on "backend_users" ("login"); CREATE UNIQUE INDEX "email_unique" on "backend_users" ("email"); CREATE INDEX "act_code_index" on "backend_users" ("activation_code"); CREATE INDEX "reset_code_index" on "backend_users" ("reset_password_code"); CREATE INDEX "admin_role_index" on "backend_users" ("role_id"); INSERT INTO backend_users SELECT * FROM backend_users_backup; DROP TABLE backend_users_backup; UPDATE system_plugin_versions SET version = '1.0.4' WHERE code = 'Flynsarmy.Mfa'; PRAGMA foreign_keys=on; -
Flyn San author
Replied on 15 Jan, 2020
Hey Guido, send me an email through the contact form on my site and I'll see if we can fix this up for you. https://www.flynsarmy.com/contact/
-
Christoph Regner
Found the plugin useful on 31 May, 2019
A useful plugin - it does what it's supposed to do.
-
Paul Grafx
Found the plugin useful on 29 Sep, 2018
Very easy setup and the support was ultra quick.
If you want a way to add extra security to your website admin access then this is it... with a little help from google authenticator.
Very happy with purchase.
-
| 1.0.21 |
Redirect to intended URL on backend login instead of the dashboard Aug 12, 2021 |
|---|---|
| 1.0.20 |
Add regenerate CLI command, better admin error handling Mar 28, 2021 |
| 1.0.19 |
Switch out qrcode dependency Jan 25, 2021 |
| 1.0.18 |
Switched out googleauth dependency Jan 18, 2021 |
| 1.0.17 |
Make compatible with Illuminate's StatefulGuard auth contract Jan 28, 2020 |
| 1.0.16 |
Minor bug fix for warning generated on first plugin installation Sep 18, 2019 |
| 1.0.15 |
Fix error when saving profiles that haven't had MFA set up yet Aug 01, 2019 |
| 1.0.14 |
Use a version of google-authenticator compatible with October's minimum PHP version Aug 01, 2019 |
| 1.0.13 |
Revert dependency updates due to issues with capitsalisation and PHP version Jun 01, 2019 |
| 1.0.12 |
Compatibility with v455, update dependencies May 28, 2019 |
| 1.0.11 |
Fix error messages when inputting incorrect MFA codes Feb 14, 2019 |
| 1.0.10 |
Security fix Jan 17, 2019 |
| 1.0.9 |
Added settings page with option to force MFA for all administrators Jan 17, 2019 |
| 1.0.8 |
Super admins can now modify MFA settings of other admins Jan 16, 2019 |
| 1.0.7 |
Fix the make_user_fields_nullable migration for new installations with DB prefixes Sep 29, 2018 |
| 1.0.6 |
Deprecated method call fix Oct 22, 2017 |
| 1.0.5 |
Case sensitivity fix Oct 15, 2017 |
| 1.0.4 |
Make user fields nullable Sep 29, 2016 |
| 1.0.3 |
Rainlab.User bug fix Oct 02, 2015 |
| 1.0.2 |
Compatibility with v204 Sep 14, 2015 |
| 1.0.1 |
Initialize plugin. Apr 24, 2015 |