Two-step sign-in
Ask for a code from an authenticator app after the password: for your LibrePortal login, for a whole rank, and for the apps behind Authelia single sign-on.
On this page
A password can be guessed, reused or read over someone's shoulder. Two-step sign-in adds a second thing a thief doesn't have: a six-digit code from an app on your phone, which changes every 30 seconds. LibrePortal has it in two separate places, and they don't affect each other:
- Your LibrePortal login, the one for the WebUI. Works on any install, including a plain
http://192.168.1.50:portone. - Authelia, the sign-in page in front of your apps, for installs with a domain.
Turning it on for your LibrePortal login#
You'll need an authenticator app on your phone. Any one will do: Aegis, 2FAS, Google Authenticator, or the one built into most password managers.
- Open My account from the menu in the top bar, and find 2-step sign-in. It says Off.
- Press Set up. A QR code appears. Scan it with your authenticator app. If you can't scan it, there's a key under it to type in instead.
- Type the six-digit code the app now shows and press Turn on. This proves the app really is set up before anything depends on it.
- Save your recovery codes. You're shown 10, once. Copy or Download them, and keep them somewhere safe, away from the computer. Press I've saved them when you have.
From then on, signing in is your password, then a code. If you ever don't have the phone, type one of the recovery codes instead of the six digits. Each recovery code works once. LibrePortal tells you when you're running low, and New recovery codes on My account makes a fresh set, replacing the old ones.
Turn off is on the same card. Both it and New recovery codes ask for your password and a code, so someone at your unlocked computer can't switch it off.
Lost your phone and your recovery codes?
An Owner can press Turn off 2-step on your page in Admin → Users. If you're the only Owner, the server's shell does the same:
Advanced Do this from the command line
sudo -u libreportal libreportal webui user 2fa-off sam
New to the command line? How to run LibrePortal commands →
Then sign in with your password and set it up again.
Requiring it for a whole rank#
If you've added people, you can insist. Open Admin → Roles, open a rank such as Co-admin, and switch on Require 2-step sign-in. Everyone with that rank is then taken to a page saying Set up 2-step sign-in to continue the next time they sign in, and nothing else works until they've done it. They can't switch it off afterwards, because their rank requires it.
Nothing requires it out of the box. Only Owners can change the rule for the built-in ranks, and your own roles have the same switch. Accounts and people explains ranks and roles.
An Owner isn't covered by a rank, so turn it on for your own account yourself.
Authelia: two steps for your apps#
If you use Authelia, it has its own two-step sign-in, separate from the WebUI's. It applies to the apps it protects: the ones you've put behind it with Authelia Integration, and the apps that use "Sign in with" single sign-on. It needs a domain and Traefik, because the sign-in only works over HTTPS. To check: confirm the exact label of the per-app single sign-on switch on an app's Config tab
On by default for new installs. When you install Authelia, its Quick settings step offers Require 2-step sign-in, already on and marked Recommended. After the password, each person is asked for a code from an authenticator app, a passkey or a security key. You can change it later on Authelia's Config tab, and the apps that sign in through it follow the choice.
Existing installs keep what they had. An Authelia installed before this setting existed stays on "a password is enough" until you turn it on yourself.
Adding a second step the first time#
Each person adds their own authenticator, passkey or security key the first time they sign in. Authelia wants to be sure it's really them before it allows that, so it sends a one-time code, normally by email. LibrePortal doesn't give Authelia a mail server, so you read the code on the server instead.
- The person starts setting up 2-step on Authelia's sign-in page. It says a code was sent.
- You open Authelia's Tools tab and run Show 2-step code. It shows the code once. It's treated like a password: only someone who may see Authelia's passwords can run it, and the log never prints it.
- They type the code and finish adding their app, passkey or key.
If there's no code waiting, the tool says so. A code expires quickly, so start the sign-in step first and run the tool straight after. If your server does send email, Authelia mails the code and there's nothing to show.
Good to know#
- Passkeys and security keys need HTTPS. Browsers only allow them on secure addresses, which a domain through Traefik gives you.
- Authelia's people are not your WebUI accounts. They have separate passwords and separate 2-step codes. Authelia keeps them in its own users file.
- Apps on a plain
ip:portaddress aren't behind Authelia. Keep those private, and turn on two-step for your WebUI login. - Two steps don't replace a good password. Keep using a long random one and a password manager.