Restrict built-in admin (custom Devolutions accounts) to login from localhost only
Restrict built-in admin (custom Devolutions accounts) to login from localhost only
0 vote
Will it be possible to add the option to restrict admin users to only login from localhost?
Imagine many "custom( Devolutions)" users on a DVLS server, all with 2FA enabled.
But to make sure that all admin users will not be locked out from 2FA failure, 2FA will not be enabled on the admin users and DS is setup with 2FA as optional.
It could be option 1 or alternative option 2
- Restrict Admin users to only login from DVLS localhost (from the server running DVLS)
- Allow Admin users to login without their 2FA from DVLS localhost (even if 2FA is mandatory and enabled on admin users)
Our worry
I am not aware if there is a way back into the system if all 2FA is lost, can local windows administrator on the DVLS server always disabled 2FA without login with a DVLS admin account?
As I see it, it seems like the DVLS console always opens the administration website and require the DVLS admin authentication, and if 2FA is lost for ever, there is no way back?
All Comments (3)
Hello,
We understand your concerns and plan to work on a much improved security policy engine as soon as we're done with implementing OpenId in our identity layer. The requests we've received are in the area of being able to increase/reduce login requirements based on IP, Geolocation, etc.
e.g.
if the client computer is on internal subnet (192.168.0.0, 10.10.0.0), do not ask 2FA.
if the client computer is using a public IP from a suspicious part of the world, add a few secret questions on top of 2FA
We'll discuss internally on the possibility of adding a patch just for localhost, add a feature to our console, or if its better to wait on our security policy engine.
Best regards,
Maurice
Maurice, sorry for bumping an older thread here.
I have the same concern as Michael but from a different standpoint: I would like to secure DVLS by only allowing Azure AD authentication - but if something is not working with this authentication we have no path to take to make changes to the configuration. A bypass from the Devolutions Server Console to allow custom user login from localhost (configured on either the 'authentication modes' level in Administration > Server Settings > Authentication; or as Michael already suggested, on the user level combined with a bypass URL) would really help.
Considering the current (latest) release: in a scenario where the 'Authenticate with Devolutions Server custom user' authentication mode is disabled, what avenues are available to restore access in the event of Office365 user authentication mode issues (e.g. expired secrets, missing applications in Azure AD, etc.)?
Hello,
In the current release, a SQL statement would need to be run by the db owner. You can contact us as service@devolutions.net to get it as required.
We do want to add a command to the console, but its not done yet.
Maurice