Use TUXEDO Cloud with 2FA and TOTP or security token - TUXEDO Computers

As a customer of TUXEDO Computers, you receive 10 GBytes of storage space in the TUXEDO Cloud per purchased device. If you have purchased several devices, you can also combine this storage space. In this help article, we want to explain how you can better protect the myTUXEDO Cloud and thus your data against unauthorized access. This is where the terms 2FA and TOTP come into play. If those do not ring a bell, here's a brief explanation of the terms before we get into the practical side of things. 

2FA and TOTP go hand in hand

2FA stands for “two-factor authentication”, and it means that logging into apps and services secured by it requires a 2nd factor in addition to the usual password, without which you can't log in. This can be a security token such as a Nitro- or Yubikey, or a time-limited one-time password (TOTP) that is sent by mail or SMS or generated on demand on a smartphone via an app such as "Google Authenticator" or the open-source counterpart "FreeOTP Authenticator" available at F-Droid. 

When logging in with a 2nd factor, there is a distinction between knowledge and possession, with possession being considered more secure. You know your password, but it can be stolen or read. A Nitrokey or an app on your smartphone is something you own. The effort for a thief to get hold of both factors is much higher than to obtain just a password. A familiar implementation of this dual concept is the combination of bank card and PIN.

Set up 2FA and TOTP

If you are a TUXEDO Computers customer and have not yet set up your myTUXEDO cloud, let's start from the beginning. First, register on myTUXEDO using the unlock code found on the back of the "Ready to go with Tux" booklet that came with your device. After receiving the confirmation email, you can log into your Tuxedo cloud, which is backed by a customized Nextcloud.

Security token: Nitrokey, Yubikey or similar devices

The most convenient way to use 2FA is to log in without a password using a security token based on the FIDO2 standard. For this, you may have to go through two additional steps when setting it up for the first time. Tokens from the manufacturers Nitrokey or Yubikey, among others, can be used for this. 

If you are in possession of such a token, then set it up in the settings of your cloud in the "Security" submenu under "Authentication without password". Insert your USB token into the device on which you want to use myTUXEDO. Then click on the "Add WebAuthn device" button. A window will then appear asking you to tap on your security key. This means your token, on which you now briefly tap with your finger when it is plugged in. You can then enter a name and click on "Add". The passwordless login should then be ready. When logging in, the application and the token match a key created during setup.

When logging in, you no longer enter a user name and password, but first click on "Log in with a device". In the mask that opens, enter your username or the e-mail address you use and click "Log in". Now a popup appears that asks you to plug in your security token and tap on it briefly. You will then be logged in without a password. If this does not work for you right away with a Nitrokey, you might need to import an udev rule. Please follow the instructions under “Troubleshooting” on the Nitrokey website If you are using Firefox, you will also need to install the pamu2fcfg package and run it once.

Setting up 2FA via TOTP with SMS or Authenticator app

Setting up 2FA with TOTP via SMS or one of the Authenticator apps mentioned above also takes place in the settings under the “Security” tab. But first, install one of the Authenticator apps mentioned above on your smartphone. Then, under Settings | Security, place a check mark next to "Enable TOTP". Your TOTP key will then be generated and displayed. The easiest way is to scan it with the QR scan function of the installed Authenticator app to establish the connection between myTUXEDO and the app. However, you can also enter the code manually in the app. 

When that is done, you can check if the connection is working based on the 2nd factor displayed in the app by entering the 2nd factor in the input field in front of the "Verify" button and clicking on it. If that was successful, then the process is complete. When you log in to your myTUXEDO cloud in the future, you will be prompted to enter the 2nd Factor. 

Attention: Finally, please generate the offered backup codes and keep them in a safe place. If your computer goes on strike, or you need to reset your smartphone, you will still have access to your TUXEDO Cloud with the codes.