Two-Factor Authentication

Function Description

Two-factor authentication allows user access only after both the client certificate and password are correct. It provides more security than the conventional authentication of only the account password.

You can upload the root and client certificates issued by the CA to the iBMC to implement secure connection between the client and the iBMC WebUI.

GUI

Choose User & Security > Two-Factor Authentication.

The Two-Factor Authentication page is displayed, as shown in Figure 3-40.

Figure 3-40 Two-Factor Authentication

Parameter Description

Enabling Two-Factor Authentication and Uploading Certificates to the iBMC

• Before the operation, apply for the root and client certificates (including the public key certificate and private key certificate) from a formal CA.
  • Private key certificates are in .pem, .p12, or .pdx format. For details about the operations, see the operation description of the CA.
  • For security purposes, periodically update the certificate.

• Base64-coded root certificate and client certificate (public key certificate) can be uploaded. Valid root and client certificate formats include *.cer, *.crt, and *.pem.

1. Click .

   Select the certificate to be uploaded. Upload the root certificate on the Root Certificate page. Upload the client public key certificate for the specified user on the Client Certificate page.

2. Click Open.

   "Operation successful" is displayed.

3. Set Two-Factor Authentication to.

Uploading a CRL

The certificate revocation file is Base64-encoded and in *.crl format. It cannot exceed 100 KB.

1. Obtain a certificate revocation file from the CA.
2. Locate the target certificate, and click in the CRL column.
3. Select the certificate revocation file.

Enabling Certificate Authentication

After uploading certificates, perform the following operations to enable certificate authentication for users who attempt to log in to the iBMC WebUI.

1. On the client, open your browser, for example, Google Chrome 81.0.4044.138.

   The operations may vary depending on the type and version of the browser.

2. Click at the upper right corner and select Settings, select Privacy and security.
3. Click Manage certificates.
4. Import the client private key certificate.

   If you are required to enter an password, enter the password that is set when you apply for the certificate.

5. Enter the iBMC login address in the address box of the browser.
6. Select the client certificate as instructed.

   Login to the iBMC WebUI is successful.

Deleting a Root Certificate

Root certificates can be deleted only when the two-factor authentication function is disabled.

1. On the Root Certificate tab page, click next to the root certificate to be deleted.

   A confirmation dialog box is displayed.

2. Click Yes.

Deleting a Client Certificate

1. On the Client Certificate page, click next to the user whose client certificate is to be deleted.

   A confirmation dialog box is displayed.

2. Click Yes.