Skip to content

Commit 5711864

Browse files
AnouckColsonpjcdawkinschadwcarlsonchadcarlson
authored
Document MFA over SSH and API (#4074)
* Document MFA over SSH and API * Updated procedures * Tweaks on both sides * Fix link * Improve consistency * Further tweaks * Clarity * Apply suggestions from review * Fix links * Fix more links * Last link * Last tweaks * Add consequence to PSH * Fix link * Update sites/upsun/src/development/ssh/troubleshoot-ssh.md Co-authored-by: Patrick Dawkins <[email protected]> * Apply suggestions from code review * Add feature availability banner to Upsun side * Add availability info on Upsun side * Update links now that #4079 is merged * Add note for use with tokens. * Test fixes: sites/platform. --------- Co-authored-by: Patrick Dawkins <[email protected]> Co-authored-by: Chad Carlson <[email protected]> Co-authored-by: chadcarlson <[email protected]>
1 parent 88d7c8a commit 5711864

File tree

15 files changed

+219
-149
lines changed

15 files changed

+219
-149
lines changed

contributing/styles/config/vocabularies/Platform/accept.txt

+1
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@ transclusion
188188
[Uu]nencoded
189189
unencrypted
190190
unmerged
191+
Upsun
191192
Uvicorn
192193
Uvloop
193194
[Uu]nmount
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
title: Security
3+
description: For enhanced security, enable Multi-Factor Authentication (MFA) or Single Sign-On (SSO).
4+
---
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
title: Multi-Factor Authentication (MFA)
3+
weight: 4
4+
keywords:
5+
- 2fa
6+
- twofactor
7+
- two factor
8+
- mfa
9+
- multifactor authentication
10+
description: Enhance your organizations' security with Multi-Factor Authentication (MFA).
11+
---
12+
13+
Multi-Factor Authentication (MFA) enhances security by protecting both your organization and every user account that interacts with it
14+
through SSH or the {{% vendor/name %}} API.
15+
16+
When MFA is enforced within an organization, every project contributor **must** enable MFA on their user account so they can run Git commands,
17+
SSH into an environment, or trigger actions through the {{% vendor/name %}} API.
18+
19+
## Enable MFA on your user account
20+
21+
To access an organization that enforces MFA or any of its projects,
22+
you **must** enable MFA on your user account.
23+
Failure to do so results in forbidden access to the organization from the Console or API,
24+
and an [error message](/development/ssh/troubleshoot-ssh.md#mfa-related-error-message) when trying to SSH into its environments.
25+
26+
To enable MFA on your user account, follow these steps:
27+
28+
1. In the Console, open the user menu (your name or profile picture).
29+
2. Click **My profile**
30+
3. Click **Security**.
31+
4. Click **Set up application**.
32+
5. Follow the instructions for the chosen authentication app.
33+
6. Click **Verify & save**.
34+
7. Refresh your SSH credentials by running `{{% vendor/cli %}} login -f` in the CLI.
35+
36+
## Enforce MFA within your organization
37+
38+
{{< premium-features/tiered "Elite and Enterprise" >}}
39+
40+
As an **admin user**, to enable MFA, open a [support ticket](/learn/overview/get-support)
41+
and request for MFA to be enforced within your organization.

sites/platform/src/administration/sso.md renamed to sites/platform/src/administration/security/sso.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: "Single sign-on (SSO)"
2+
title: "Single Sign-On (SSO)"
33
weight: 4
44
description: |
55
{{% vendor/name %}} allows you to set up mandatory SSO with a third-party identity provider (IdP) for all your users.

sites/platform/src/administration/web/mfa.md

-23
This file was deleted.

sites/platform/src/development/ssh/_index.md

+5-8
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,10 @@ There are three basic ways to authenticate with {{% vendor/name %}}:
164164
* Good for letting automation tools use the CLI.
165165
* Requires you to regularly change the tokens to maintain security.
166166

167-
## Multifactor authentication (MFA) over SSH
167+
## SSH into an MFA-protected environment
168168

169-
{{< premium-features/tiered "Enterprise and Elite" >}}
169+
For enhanced security, as an organization owner or admin user,
170+
you can [enforce Multi-Factor Authentication (MFA) within your organization](/administration/security/mfa.md#enforce-mfa-within-your-organization).
170171

171-
To enhance security, Enterprise and Elite customers can enforce MFA over SSH within their organization.
172-
When this is enabled, every project contributor within your organization must enable MFA in their account
173-
to run Git commands or to SSH in an environment.
174-
To enable this feature, open a [support ticket](/learn/overview/get-support) and request for MFA over SSH to be enforced within your organization.
175-
176-
If you have trouble accessing an environment with MFA enabled, see how to [add a second factor](./troubleshoot-ssh.md#add-a-second-authentication-factor).
172+
As a project contributor, if you haven't enabled MFA on your user account and SSH into an environment that is protected by MFA,
173+
you get an error message. See how you can [troubleshoot that error message](/development/ssh/troubleshoot-ssh.md#mfa-related-error-message).

sites/platform/src/development/ssh/troubleshoot-ssh.md

+36-45
Original file line numberDiff line numberDiff line change
@@ -72,53 +72,11 @@ IdentityFile ~/.ssh/id_{{% vendor/alt-name %}}
7272
Be aware that, above, `{{% vendor/alt-name %}}` stands for a hostname.
7373
Each different hostname you connect to {{< vendor/name >}} at may have to be specified in the host line, separated by spaces.
7474
75-
## Check your git integrations
75+
## Check your Git integrations
7676
77-
If your project is integrated with another git provider (such as GitHub), that provider controls git operations.
77+
If your project is integrated with another Git provider (such as GitHub), that provider controls Git operations.
7878
Make sure you have added your public SSH key to your provider and that your user there has access.
7979
80-
## Add a second authentication factor
81-
82-
If your organization has [multifactor authentication set up](./_index.md#multifactor-authentication-mfa-over-ssh),
83-
you may get an error like the following when trying to log into your environment with SSH keys:
84-
85-
```bash
86-
Hello {{< variable "NAME" >}} (UUID: {{< variable "USER_ID" >}}), you successfully authenticated, but could not connect to service {{< variable "USER_ID" >}} --app
87-
(reason: access requires MFA)
88-
{{< variable "ENVIRONMENT_ID" >}}@ssh.{{< variable "REGION" >}}.{{< vendor/urlraw "host" >}}: Permission denied (publickey)
89-
```
90-
91-
If you are using just `ssh` and not `{{% vendor/cli %}} ssh`, you may see only the second half of the error:
92-
93-
```bash
94-
{{< variable "ENVIRONMENT_ID" >}}@ssh.{{< variable "REGION" >}}.{{< vendor/urlraw "host" >}}: Permission denied (publickey)
95-
```
96-
97-
To resolve this:
98-
99-
{{< codetabs >}}
100-
+++
101-
title=Using the CLI
102-
+++
103-
104-
Log in using the browser by running `{{% vendor/cli %}} login`.
105-
106-
<--->
107-
108-
+++
109-
title=In the Console
110-
+++
111-
112-
1. Open the user menu (your name or profile picture).
113-
2. Click **My profile**
114-
3. Click **Security**.
115-
4. Click **Set up application**.
116-
5. Follow the instructions for the chosen authentication app.
117-
6. Click **Verify & save**.
118-
7. Refresh your SSH credentials by running `{{% vendor/cli %}} login -f` in the CLI.
119-
120-
{{< /codetabs >}}
121-
12280
## Generate SSH debug information
12381
12482
If your private key and public key both look OK but you don't have any luck logging in, print debugging information.
@@ -152,8 +110,41 @@ GIT_SSH_COMMAND="ssh -v" git clone {{< variable "REPO_URL" >}}
152110
153111
You can use this information to make one last check of the private key file.
154112
113+
## MFA-related error message
114+
115+
If you haven't enabled MFA on your user account and try to SSH into an environment that is protected by MFA,
116+
you get the following error message:
117+
118+
```bash
119+
Error: Access denied
120+
Service: abcdefg123456-main-bvxea6i--app
121+
User: {{< variable "USER NAME" >}} ({{< variable "USER ID" >}})
122+
Parameters: {"amr":["mfa","sso:acme"]}
123+
Detail: Additional authentication is required:
124+
- Multi-factor authentication (MFA)
125+
- Single sign-on (SSO), provider: "acme"
126+
```
127+
128+
To solve this, [enable MFA on your user account](/administration/security/mfa.md#enable-mfa-on-your-user-account).
129+
130+
Alternatively, open the Console and select the desired organization.
131+
Follow the instructions so you can effectively access its contents.
132+
133+
Similarly for bot users and CLI tokens, you may see the message:
134+
135+
```bash
136+
[RequestException]
137+
Multi-factor authentication (MFA) is required.
138+
The API token may need to be re-created after enabling MFA.
139+
```
140+
141+
In this case, as described, it will be necessary to:
142+
143+
1. Enable MFA on the (bot) user account associated with the token.
144+
2. Generate a new access token, and then replace its value in your workflow that requires the token (such as updating a GitHub workflow secret variable).
145+
155146
## Something still wrong?
156147

157148
For more general information, see how to [troubleshoot development](/development/troubleshoot).
158149

159-
If you're still stuck, open a [support ticket](/learn/overview/get-support) and provide the full SSH debug information.
150+
If you're still stuck, open a [support ticket](/learn/overview/get-support) and provide the full SSH debug information.

sites/platform/src/guides/ibexa/deploy.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ description: Learn how to use Ibexa DXP on {{% vendor/name %}}.
77

88
Ibexa DXP is a digital experience platform with a focus on delivering effective content, offering personalized customer journeys, and facilitating multi-channel purchases and customer service.
99

10-
Ibexa Cloud, based on Platform.sh, is the fastest solution to build and run Ibexa projects.
10+
Ibexa Cloud, based on {{% vendor/name %}}, is the fastest solution to build and run Ibexa projects.
1111

12-
See how to [install Ibexa DXP on Platform.sh through Ibexa Cloud](https://doc.ibexa.co/en/latest/getting_started/install_on_ibexa_cloud/).
12+
See how to [install Ibexa DXP on {{% vendor/name %}} through Ibexa Cloud](https://doc.ibexa.co/en/latest/getting_started/install_on_ibexa_cloud/).
1313

1414
## Redis
1515

sites/platform/src/learn/overview/get-support.md

+2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ Once you submit a ticket, you see it in a list of all tickets created, for all p
2727
Note that once you submit the ticket, you can't modify or delete the submission.
2828
If you have any additional information, you can select the submitted ticket and write a message.
2929

30+
<!-- vale off -->
3031
## Slack
3132

3233
To talk about app development or framework-related questions,
@@ -36,6 +37,7 @@ join other customers and engineers in the [public Slack channel](https://chat.pl
3637

3738
The [{{% vendor/name %}} Community site](https://community.platform.sh/) has how-to guides with suggestions
3839
on how to get the most out of {{% vendor/name %}}.
40+
<!-- vale on -->
3941

4042
## Contact Sales
4143

sites/upsun/src/administration/billing/add-on-subscription.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ The Standard User Management add-on gives you access to the following features:
2020
- Free [viewer permissions](../users.md)
2121
- Custom [organization permissions](../users.md#organization-permissions)
2222
- [Teams](/administration/teams.md)
23-
- [MFA enforcement within an organization](/administration/web/mfa.md)
23+
- [MFA enforcement within an organization](/administration/mfa.md)
2424

2525
### Upgrade to the Standard User Management add-on
2626

sites/upsun/src/administration/mfa.md

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
title: Multi-Factor Authentication (MFA)
3+
weight: 4
4+
keywords:
5+
- 2fa
6+
- twofactor
7+
- two factor
8+
- mfa
9+
- multifactor authentication
10+
description: Enhance your organizations' security with Multi-Factor Authentication (MFA).
11+
---
12+
13+
Multi-Factor Authentication (MFA) enhances security by protecting both your organization and every user account that interacts with it
14+
through SSH or the {{% vendor/name %}} API.
15+
16+
When MFA is enforced within an organization, every project contributor **must** enable MFA on their user account so they can run Git commands,
17+
SSH into an environment, or trigger actions through the {{% vendor/name %}} API.
18+
19+
## Enable MFA on your user account
20+
21+
To access an organization that enforces MFA or any of its projects,
22+
you **must** enable MFA on your user account.
23+
Failure to do so results in forbidden access to the organization from the Console or API,
24+
and an [error message](/development/ssh/troubleshoot-ssh.md#mfa-related-error-message) when trying to SSH into its environments.
25+
26+
To enable MFA on your user account, follow these steps:
27+
28+
1. In the Console, open the user menu (your name or profile picture).
29+
2. Click **My profile**
30+
3. Click **Security**.
31+
4. Click **Set up application**.
32+
5. Follow the instructions for the chosen authentication app.
33+
6. Click **Verify & save**.
34+
7. Refresh your SSH credentials by running `{{% vendor/cli %}} login -f` in the CLI.
35+
36+
## Enforce MFA within your organization
37+
38+
{{< note theme="info" title="Feature availability and permissions">}}
39+
40+
This feature is available as part of the Standard User Management add-on.
41+
To add it to your project, [administer your organization's billing](/administration/billing/billing-admin).
42+
43+
Only **organization owners** and **admin users** can enable MFA within an organization.
44+
However, even if you have the required permissions,
45+
you **must** [enable MFA on your user account](#enable-mfa-on-your-user-account) prior to enforcing it within the whole organization.
46+
47+
{{< /note >}}
48+
49+
To enable MFA within your organization, follow these steps:
50+
51+
1. In the Console, open the user menu (your name or profile picture).
52+
2. Click **Settings**.
53+
3. Click **Security**.
54+
4. In the **MFA required** area, set the **Enable** toggle on.
55+
56+
{{< note >}}
57+
58+
Under **User security settings**, you can view which users in your organization have [activated MFA for their user accounts](#enable-mfa-on-your-user-account).
59+
60+
{{< /note >}}
61+
62+
### Send email reminders
63+
64+
You can send email reminders to users who haven't enabled MFA on their user account yet.
65+
To do so, follow these steps:
66+
67+
1. In the Console, open the user menu (your name or profile picture).
68+
2. Click **Settings**.
69+
3. Click **Security**.
70+
4. In the **User security settings** area, find the user you want to send a reminder to.
71+
5. Click **{{< icon more >}} More** next to that user.
72+
6. Select **Remind**.</br>
73+
An email is sent to the user with instructions on how to enable MFA on their user account.
74+
75+
{{< note >}}
76+
77+
You can send reminders to multiple users at once.</br>
78+
To do so, in the **User security settings** user list,
79+
select the desired users by checking the boxes in front of their names.
80+
Click **Remind** at the top of the list to trigger the reminder emails.
81+
82+
{{< /note >}}

sites/upsun/src/administration/users.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ When a user is added to a project, they are automatically added to your organiza
1111
{{< note title="Available add-on" >}}
1212

1313
The Standard User Management add-on offers free viewer permissions, custom [organization permissions](#organization-permissions),
14-
[teams](/administration/teams.md), and [MFA enforcement within an organization](/administration/web/mfa.md).
14+
[teams](/administration/teams.md), and [MFA enforcement within an organization](/administration/mfa.md).
1515
See how to [subscribe to this add-on](/administration/billing/add-on-subscription.md#standard-user-management-add-on).
1616

1717
{{< /note >}}

sites/upsun/src/administration/web/mfa.md

-23
This file was deleted.

sites/upsun/src/development/ssh/_index.md

+8
Original file line numberDiff line numberDiff line change
@@ -163,3 +163,11 @@ There are three basic ways to authenticate with {{% vendor/name %}}:
163163
* [Using API tokens](../../administration/cli/api-tokens.md)
164164
* Good for letting automation tools use the CLI.
165165
* Requires you to regularly change the tokens to maintain security.
166+
167+
## SSH into an MFA-protected environment
168+
169+
For enhanced security, as an organization owner or admin user,
170+
you can [enforce Multi-Factor Authentication (MFA) within your organization](/administration/mfa.md#enforce-mfa-within-your-organization).
171+
172+
As a project contributor, if you haven't enabled MFA on your user account and SSH into an environment that is protected by MFA,
173+
you get an error message. See how you can [troubleshoot that error message](/development/ssh/troubleshoot-ssh.md#mfa-related-error-message).

0 commit comments

Comments
 (0)