Dont use 2FA from local LAN or specified networks

newbie75 · September 9, 2021, 4:55pm

Hi there,

is there a way to not use 2FA from local network or specified IP addresses?
I like to just use normal login from e.g. local lan (or specified external IP addresses), but will have 2FA enabled from outside from all other places.
I’m using nc 20.0.5

wwe · September 9, 2021, 7:41pm

I think it’s not possible. I know especially when you setup new system and login multiple times, using different users, for testing and so on… 2FA might be annoying but this usually not the case for daily operations… In general 2FA is not as disturbing as it seems to - once you whitelist your NC domain and your browser keeps the session cookie you remain logged in for ages… and if you get new device it’s not hard to follow 2FA login once (per app) - and I bet you appreciate this extra security layer as well…

newbie75 · September 10, 2021, 6:22am

Ok, thanks for the answer. It’s not annoying…maybe more laziness on my part

bb77 · September 10, 2021, 6:54am

Hi @newbie75

I found manually entering the TOTP code every time I wanted to login kind of annoying. Then at some point I ordered two YubiKeys and set up U2F. Now entering the second factor is just one button press on the YubyKey. Of course this has the disadvantage that if you don’t have your YubiKey with you, then you can’t log in. But since I mainly need Nextcloud as a backend for the Android app and for syncing my calendar when I’m on the road, that’s not really an issue. And if you always have the second YubiKey on your keychain, it’s a non-issue anyways.

das1996 · May 13, 2022, 10:10pm

Can you please elaborate. Whitelist how/where? Which domain, local server domain? Thanks

wwe · May 14, 2022, 7:30pm

in your browser. successful authentication results in some cookies placed on the system. this cookies allow yo you to access Nextcloud (or any other service) within cookie lifetime.

You should familiarize yourself with some very basic concepts of web application before you start hosting somewhat complex software like Nextcloud…

AndyXheli · October 7, 2022, 6:15pm

Yes, I think having an option to not force 2FA from specific IPs or local network work be awesome. Currently O365 has this option under their conditional access rules. I don’t see a reason to enforce 2fa under your local network. Since users are on a secure network no need to force 2fa but if they login outside of the network then enforce it

Also seems like a lot of users are asking for it

github.com/nextcloud/server

[TwoFactorAuth] Issue second factor challenge depending on the channel of access

opened 11:07AM - 07 Nov 16 UTC

GitHubUser4234

enhancement 1. to develop security feature: authentication

Hello, This is a small additional feature I would like to contribute, it is a…bout Two-Factor-Authentication. The goal is to issue the second factor challenge depending on the channel of access. For example only users accessing Nextcloud through the internet should be asked to enter their OTP, while users from the intranet only need to enter the usual username/password to gain access. There are quite a number of environments conceivable where such a feature could prove useful. For this to work, a common request header is used to determine whether the second factor challenge should be skipped. The header name is proposed to be `NC_2FA_SKIP` and the expected value would be `"true"`. I recently discussed this with @ChristophWurst who was kind to point me to a starting point in the [OC\Authentication\TwoFactorAuth\Manager class](https://github.com/nextcloud/server/blob/1c8f9d665548cd5c9437beaa62d71bb234b5f6ac/lib/private/Authentication/TwoFactorAuth/Manager.php#L62-L71). Once I'll get the code ready, I'll open a PR.

devnull · October 8, 2022, 4:03am

That is not fully true. With malware on the client the hacker can use the local client like an external client.

A browser is stateless instead a fully Nextcloud client. With 2FA you get a massive security improvement.

kentravis · January 1, 2023, 9:57pm

I second that. Yes, excluding local networks from 2FA is common and desirable - most all commercial enterprise apps have that option now. If your local network is correctly secured, then being on it serves as the second factor. The major threat is from the Internet (if they are inside and logged into your local network, you got much bigger problems). We want to make our users happy and productive, so the easier we can make it for them, the better.

devnull · January 2, 2023, 1:39pm

@kentravis
Yes i think you are right.
@kentravis @newbie75
Maybe someone can write for the app Two-Factor TOTP Provider an issue here.

Where we are at:
Couldn’t you do without the password when logging in via 2FA? I would find that practical.

bb77 · January 2, 2023, 1:46pm

github.com/nextcloud/server

[TwoFactorAuth] Issue second factor challenge depending on the channel of access

opened 11:07AM - 07 Nov 16 UTC

GitHubUser4234

enhancement 1. to develop security feature: authentication

Hello, This is a small additional feature I would like to contribute, it is a…bout Two-Factor-Authentication. The goal is to issue the second factor challenge depending on the channel of access. For example only users accessing Nextcloud through the internet should be asked to enter their OTP, while users from the intranet only need to enter the usual username/password to gain access. There are quite a number of environments conceivable where such a feature could prove useful. For this to work, a common request header is used to determine whether the second factor challenge should be skipped. The header name is proposed to be `NC_2FA_SKIP` and the expected value would be `"true"`. I recently discussed this with @ChristophWurst who was kind to point me to a starting point in the [OC\Authentication\TwoFactorAuth\Manager class](https://github.com/nextcloud/server/blob/1c8f9d665548cd5c9437beaa62d71bb234b5f6ac/lib/private/Authentication/TwoFactorAuth/Manager.php#L62-L71). Once I'll get the code ready, I'll open a PR.