2FA directly into Poznote ?

[jojobricolo57]

Hello, I use Poznote a lot (exclusively!), but setting up two-factor authentication (2FA) is complicated and resource-intensive (Authelia, Authentik, etc.). As for using Google’s services, I’ve already tested them, but my goal is to minimize the amount of information sent to Google as much as possible, so that solution doesn’t work for me.
I’m also happily using NPM (Nginx Proxy Manager) in Docker (thanks, Tim, for the tip!), and NPM apparently uses an “internal” 2FA for its services.
So I was wondering if it might be possible to integrate 2FA directly into Poznote, similar to how NPM does it.
2FA has become much more widespread, and these days it’s no longer a luxury when it comes to security.
Thank you

[timothepoznanski]

Hello!

Are you talking about that?

#1463

Tim

[jojobricolo57]

If I understand correctly (??), no, I'm not talking about connecting to a 2FA service (like Google), but rather about two-factor authentication implemented directly within Poznote, as it is in Nginx Proxy Manager. The goal is to make 2FA simple and easy to use.

[timothepoznanski]

Are you using login and password to connect to Poznote ?

[jojobricolo57]

Yes, basic authentication: username and password

[timothepoznanski]

Ok so it is fine. 😊 Poznote has already two-factor authentication implemented directly within Poznote when you use login and password.

Goes to "Settings" > "My account" > "Two factor authentication"

[jojobricolo57]

Great!
I updated Poznote because my version didn't have 2FA (yet).
Thanks so much, and sorry for the trouble—I should have updated before asking the question...

[timothepoznanski]

No problem, this feature arrived yesterday. 😉

[jojobricolo57]

One more question:
If I run into a problem and need to reset the password, is there a solution involving the .env file?
For example, can I disable 2FA and revert to a standard login/password directly in the .env file if I lose both my credentials and 2FA access?
How should I proceed if I lose both my login credentials and 2FA access?
Thanks.

[timothepoznanski]

Hello!

No, nothing goes through the .env file: passwords and two-factor are stored in the database, not in .env, so there is nothing to switch off there. But you are covered in three ways.

1. When you turned two-factor on, Poznote gave you a set of recovery codes. Each one signs you in once instead of the 6-digit code: on the code screen, choose "Use a recovery code". Keep them somewhere safe (password manager, printed copy).
2. If another administrator can still sign in, they can turn two-factor off for your account, or set you a new password, from Settings > Admin Tools > User Management.
3. If you are the only user and you lost the password, the device and the recovery codes, you can fix it directly in the master database from your Poznote directory on the host (the sqlite3 command-line tool must be installed there):

sudo sqlite3 data/master.db "UPDATE users SET password_hash=NULL, password_login_disabled=0 WHERE id=1;"

sudo sqlite3 data/master.db "DELETE FROM user_totp_recovery_codes WHERE user_id=1; DELETE FROM user_totp WHERE user_id=1;"

The first line resets the password of the first account (id 1, always an administrator) to the default "admin", the second removes two-factor for it. Then sign in with the username and "admin", change the password right away, and set two-factor up again if you want it.

Both cases are documented here:
https://github.com/timothepoznanski/poznote/blob/main/docs/TROUBLESHOOTING.md#two-factor-lockout (the "Lost administrator password" entry is just above it).

Tim

[jojobricolo57]

Great! Thanks, I'm saving the link and the info in my files "just in case."
Thanks again!

[kMikaZu]

Is there a way to force 2FA on all users?

[timothepoznanski]

No but I could create a setting in the admin settings part.

[timothepoznanski]

Working on it!

[kMikaZu]

I say this in a way full of admiration and friendship: you are nuts! The way you maintain this product and how it's actually far more advanced than paid models on a lot of levels... I will buy you a coffee! To support you!

[timothepoznanski]

Haha, thank you so much! 😂❤️ Honestly, messages like this mean a lot to me. Poznote is a passion project, and knowing that people appreciate the work I put into it makes all the time and effort worthwhile. Thanks for the support and the coffee! ☕️

[timothepoznanski]

[timothepoznanski]

It's done: there is a new "Require two-factor" setting in Settings > Admin Tools. Once it is on, every account that signs in with a password has to use two-factor authentication: an account that has not set it up yet is asked to do it right on the login page (QR code, first code, then its recovery codes), and sessions opened without it end.

While it is required, users can no longer turn it off themselves, and the account password alone stops working through the API (app passwords keep working). SSO logins are not concerned, since the identity provider handles their second factor. It will be in the next release.

[timothepoznanski]

Could you please try the 6.132.0-beta and let me know if it works as excpected for you? Thanks. 😊