Alex Corcoles via FreeIPA-users wrote:
Hi,
I run a FreeIPA domain as a hobbyist, basically to get password sync
among my boxes and some services. Right now I'm the sole admin (and
user). I've been toying with the idea of adding 2FA, but I wonder if
there's a good solution if I lose my token.
I guess I can have some sets of printed one-time passwords (one in my
wallet, another at home, another at a bank safe or whatever), but that
could not work well if I'm travelling or something.
I'm thinking having multiple tokens might cover some eventualities, but
I guess there are failure scenarios where all tokens get disabled.
Are there any other strategies?
If 2FA is done right then yeah, you should be locked out if you've
lost/disabled/don't have all your tokens. If not then there is a serious
vulnerability.
I imagine that as a last resort you could disable 2FA as Directory Manager.
rob