Resolved Is it possible to force 2FA?

[Steg]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

Obsidian 18.0.50.2

Is it possible to force user accounts to enable 2FA?

 

[Peter Debik]

As far as I know it cannot be enforced. Users can enable and disable Google Authenticator in their subscriptions. The option to disable it is also important, because sometimes users crash their phones and don't have the backup keys. If you believe that enforcement of 2FA is something that Plesk should add, please create a feature request on User Voice Feature Suggestions: Top (1801 ideas) – Your Ideas for Plesk

 

[MarkM]

Plesk 2FA still leaves API as well as the Mobile app accessible without 2FA unless you also disable XML-RPC API. I personally wouldn't worry about forcing it, and as far as I know, it's also not possible to do so.

 

[Steg]

Thanks guys. I've added a feature request for it. If anyone else runs across this thread and agrees, please vote for it.

Add the ability to require 2FA for accounts.

Many sites and online providers today require the use of 2FA to secure accounts. It would be great if Plesk could require the same thing (at least for administrative accounts). I think this could really help increase the security posture of the software. As it stands now, Google Auth is...

plesk.uservoice.com

 

[Steg]

Thank you for adding this Plesk team!