Two-Factor Authentication Across Your Entire Stack

Passwords are broken. They are reused, guessed, phished, leaked in breaches, and written on sticky notes. Two-factor authentication fixes the most common failure mode: even if an attacker obtains a password, they cannot log in without the second factor, which is typically a time-based code from an authenticator app or a hardware security key. Every business-critical application should enforce 2FA.

Level 1: Your SSO Gateway

The most efficient way to enforce 2FA across your stack is through your authentication gateway. Authelia, the SSO solution VPS1 deploys, supports TOTP-based two-factor authentication out of the box. When a user logs in to Authelia, they provide their password and a six-digit code from their authenticator app. Once authenticated, they can access every application behind Authelia without additional logins. This gives you 2FA on every application with a single configuration change. No per-application setup required.

Pair this with WebAuthn support for hardware security keys like YubiKey. Hardware tokens are phishing-resistant because they verify the domain before authenticating. A fake login page cannot trick a YubiKey.

Level 2: Per-Application 2FA for Applications Outside Authelia

Not every application sits behind Authelia. Some teams need direct access for mobile sync, API access, or federated sharing. For these applications, enable 2FA directly within the application:

• Nextcloud: Built-in TOTP 2FA support in Security settings
• Vaultwarden: TOTP and Duo push notification support
• Grafana: OAuth with 2FA through your identity provider
• Portainer: OAuth integration for delegated authentication

Level 3: SSH and Server Access

SSH keys are better than passwords, but SSH keys with 2FA are better still. Configure your servers to require both an SSH key and a TOTP code for login. This protects against key theft: if someone's laptop is stolen and their private SSH key is extracted, they still cannot access your servers without the second factor.

What About Recovery Codes?

Every 2FA setup needs a recovery mechanism. Generate recovery codes during 2FA setup and store them securely, printed and locked in a safe or encrypted in a password manager. Without recovery codes, a lost phone means permanent account lockout. VPS1 generates and securely stores recovery codes for managed clients.

Enforcing 2FA Across Your Team

2FA only works if everyone uses it. Set a policy: all accounts must have 2FA enabled. For Authelia, disable password-only authentication so 2FA is not optional. Audit regularly to confirm compliance. The security benefit of 2FA disappears if even one account skips it.

VPS1 configures 2FA at the SSO gateway level for all managed clients. Your team gets one login with one second factor, enforced across every application.