Authentication & Multi-Factor Authentication (MFA)

Secure your privileged bastion using multi-factor authentication (TOTP), robust password rotation rules, and brute-force defenses.

Section: Configuration Standards: RFC 6238 TOTP

Authentication Overview

AllSafeX implements a two-stage verification process for all interactive and SSH gateway connections. Administrators and operators cannot establish connections to backend infrastructure without satisfying both stages:

Primary Credential: Strong enterprise password or public key.
Secondary Credential: Time-based One-Time Password (TOTP) generated by an authenticator application.

Enrolling TOTP MFA

AllSafeX is compatible with any RFC 6238-compliant authenticator application, including Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, and YubiKey OATH.

Log into the AllSafeX Web Console.
Click your user profile in the top right corner and navigate to User Settings → Multi-Factor Authentication.
Scan the displayed QR code with your authenticator mobile app.
Enter the 6-digit code shown in your app to confirm enrollment.

MFA Enforcement

In production environments, we strongly recommend enabling SECURITY_MFA_AUTH: true in config.yml. This prevents any user from logging in until they have enrolled their MFA device.

Password Complexity Policies

Enforce enterprise password hygiene via config.yml:

Setting Key	Default	Description
`SECURITY_PASSWORD_MIN_LENGTH`	`12`	Minimum required password character length.
`SECURITY_PASSWORD_UPPERCASE`	`true`	Requires at least one uppercase letter (A-Z).
`SECURITY_PASSWORD_NUMERIC`	`true`	Requires at least one numeric digit (0-9).
`SECURITY_PASSWORD_SPECIAL`	`true`	Requires at least one special character (!@#$%^&*).
`SECURITY_PASSWORD_EXPIRY_DAYS`	`90`	Forces password rotation every 90 days.

Brute-Force & Account Lockout

To prevent brute-force attacks against the web console and AllSafeX SSH gateway, AllSafeX automatically locks an account after 5 consecutive failed authentication attempts for a duration of 15 minutes.

MFA Reset & Recovery

If an administrator loses their authenticator device, a superuser can reset MFA via the CLI container:

# Execute the Django management command inside the core container
docker compose exec core python manage.py reset_mfa --username=john_doe