2FA

[indomitorum]

Is 2FA something Umbrel is working on?. It certainly lacks more security as access to your node by a bad actor can drain your funds.

[dsbaars]

This is already mentioned in issue #985 but adding this as a separate issue might help in actually building this feature.

[indomitorum]

After the recent events. I do think that this is a priority even if Umbrel doesn't as I have been told recently.

[dsbaars]

I finished building this functionality yesterday.

• It works with every Google Authenticator-compatible TOTP app.
• It adds extra security to the Umbrel dashboard, which is also exposed over Tor.
• It is optional to use.

20211117-2fa-demo.mp4

I'm already using it on my Umbrel mainnet environment as well, my only concern is that the user.json needs a manually addition at this moment. I can't seem to find any migration hooks in the update scripts, or am I missing something here?

[AaronDewes]

Can you share some code? What exactly is required to be added to user.json manually during the update script?

[mayankchhabra]

That looks very well done! Great job, @dsbaars. Thanks for taking this on!

Migration code to update user.json can be added to scripts/update/01-run.sh which will be automatically executed on the next OTA update. See for example this piece of code that stripped Lightning Terminal's password in the last OTA update:

umbrel/scripts/update/01-run.sh

Lines 239 to 244 in dae920c

	# Handle stripping hardcoded password for lightning-terminal app
	lightning_terminal_conf="${UMBREL_ROOT}/app-data/lightning-terminal/data/.lit/lit.conf"
	if [[ -f "${lightning_terminal_conf}" ]]; then
	echo "Found lightning-terminal install, attempting to strip hardcoded password..."
	sed -i 's/uipassword=moneyprintergobrrr//' "${lightning_terminal_conf}"
	fi

[dsbaars]

Can you share some code? What exactly is required to be added to user.json manually during the update script?

Here is the code:
@dsbaars/umbrel-manager#feature/2fa
@dsbaars/umbrel-dashboard#feature/2fa

Two keys need to be added to user.json:

{
  "totpKey": "",
  "totpEnabled": false
}

[Dar1Theory]

Ok, I've downloaded 4.9. I didn't turn on 2fa on either node. However, one node works (no 2fa) the other is asking for my 2fa (which obviously I don't have since I didn't set it up).
Please tell me what conf or json contains the "turn 2fa off" switch?

[nmfretz]

Closed by:
getumbrel/umbrel-manager#112
getumbrel/umbrel-manager#112