How to deactivate 2FA

[Flooxou]

Hello,
Now with the new version of Teleport, it is possible to disable the 2FA. But I have the impression that it is not done as before version 16. Is it possible to document how the deactivate? and is it possible to do it with teleport as a package or do you need the docker version?

[webvictim]

You need to set the TELEPORT_ALLOW_NO_SECOND_FACTOR environment variable to yes, then restart Teleport.

Assuming you're running Teleport with systemd, this is most easily done like this:

echo "TELEPORT_ALLOW_NO_SECOND_FACTOR=yes" | sudo tee -a /etc/default/teleport
sudo systemctl restart teleport

For Kubernetes-based deployments using the teleport-cluster Helm chart, you'll need to add it to your chart values and then helm upgrade:

extraEnv:
- name: TELEPORT_ALLOW_NO_SECOND_FACTOR
  value: yes

[Flooxou]

I tried this method but when I restart teleport, I always need to do the 2FA. Even if I try to create a new user. I am in version 17.0.3 however.

[zmb3]

It should work in version 17.0.3.

You'll need to set the env var and set second_factor: off in your configuration.

• Teleport 15 and earlier allow you to disable MFA without setting any env var.
• Teleport 16 requires you to set TELEPORT_ALLOW_NO_SECOND_FACTOR=yes in order to disable MFA.
• Teleport 17.0.1-17.0.2 provide no way to disable MFA.
• Teleport 17.0.3 restores the Teleport 16 behavior.

[Flooxou]

Ahhhh thank you, I hadn't put second_factor: off.

[manish-chalo]

Any way to disable mfa in version 18.3.2 or higher?

[Flooxou]

I'm still on version 1.17 and it continues to work without MFA. However, you need to be careful with the TELEPORT_ALLOW_NO_SECOND_FACTOR variable; you probably need to set it to “True.” Teleport is a little temperamental following an update.

[Flooxou]

For the second_factors: off to work, you must set the TELEPORT_ALLOW_NO_SECOND_FACTOR environment variable to True, like this: TELEPORT_ALLOW_NO_SECOND_FACTOR=True in your deployment

[13567436138]

^Croot@ubuntu:~# kubectl logs -n teleport teleport-auth-767ff767d8-5npbx
ERROR: cannot disable multi-factor authentication

[13567436138]

18

[Flooxou]

I need more details to understand why it's not working. Please provide your Kube manifest with the sensitive keys anonymized.