How can i activte Only 2FA Login for Accounts

[Nomex1337]

Hi like in title say,

how can i set the config so User can Only Login in with username and password and then 2FA Autheification token from Smartphone?

With the the settings i get this error in my synology container log

{
"$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
"settings": {
"plugins": {"enabled": false},
"_mongoDb": null,
"cert": "remote.example.de",
"WANonly": false,
"LANonly": false,
"sessionKey": "balabalalallalallala",
"trustedProxy": "192.168.178.10",
"port": 443,
"_aliasPort": 8443,
"redirPort": 80,
"_redirAliasPort": 80,
"AgentPong": 300,
"TLSOffload": "192.168.178.10",
"SelfUpdate": true,
"AllowFraming": false,
"WebRTC": false
},
"domains": {
"": {
"_title": "MyServer",
"_title2": "Servername",
"minify": true,
"NewAccounts": false,
"localSessionRecording": false,
"_userNameIsEmail": true,
"certUrl": "https://remote.example.de:443"
}
},
"passwordRequirements": {
"force2factor": true,
"twoFactorTimeout": 300
},
"_letsencrypt": {
"comment": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
"_email": "",
"_names": "",
"production": false
}
}

[si458]

the passwordRequirements should go INSIDE of the domains ""

"domains": {
  "" : {
    "title": "myserver",
    "passwordRequirements": {
      "force2factor": true,
      "twoFactorTimeout": 300
    }
  }
}

[si458]

https://ylianst.github.io/MeshCentral/messaging/#two-factor-authentication

[Nomex1337]

Oh i am a noob - thank you so mutch si458 - Kiss Kiss

[Nomex1337]

ok still not working Users without 2FA Authentication set can still login only with username and password

"domains": {
"": {
"_title": "MyServer",
"_title2": "Servername",
"minify": true,
"NewAccounts": false,
"localSessionRecording": false,
"_userNameIsEmail": true,
"certUrl": "https://remote.exapmle.de:443",
"passwordRequirements": {
"force2factor": true,
"twoFactorTimeout": 300
}
}
},

[si458]

this is correct, because how else would they setup 2fa to begin with!?
they login without 2fa, then they get a notification saying please setup 2fa otherwise you cant do anything,
they then setup 2fa, then they can use meshcentral

[Nomex1337]

but what is happened when a user is login has no 2FA but has still admin rights for a group of devices he can opload stuff an can delete diveses only with group actions. i can give Users the option the set a password with 12 characters but if they get no good password combination a hacker can came in.

[si458]

are you making sure you restart ur meshcentral server every time u change the config.json?

[Nomex1337]

Yeah for Sure - is a user signed in he can not get access to pc for remote

but he can do that

or

[si458]

ok just replicated what you mean,
with the option enabled, if i try to navigate round the web ui, it displays the warning saying "not possible, plz enable 2fa"
HOWEVER if i i use anything from the group actions list, then its still possible to achive this!
so its a bug thank you for find it :)
please can u open a bug report on here, follow the template and explain what u/i said, the fact force2fa doesnt stop group actions from working!

[Nomex1337]

ok i did - thank for solving the problem to get activte.