Two-factor Authentication

I would suggest (at least the option for administrators, of) building on existing two-factor auth instead of creating a new one.

For example:

https://alteregoapp.com/

http://code.google.com/p/google-authenticator/

I support two-factor authentication, such a service should support different third party services. We use Yubico.com for other internal authentication services and would like to see a two-factor autchentication service supporting this.

I really like if Google Authenticator was an optional choice for WHM and cPanel users.

This makes password theft and brute force attacks as good as useless.

I think it should also allow to choose a different service as well. Duo Security also offers a good solution. If programed correctly there can be certain built in choice and a way to add a custom one

I would love to have Google Authenticator for WHM and cPanel (optional if the user wants), it would definitely make me sleep better at night.

I'm suprised something like this hasn't been implemented yet.

I'm sure each dev/admin that want/need this can pool up some $ towards making it happens. Can someone Kickstart it?

For example, my company, which is very small, would gladly pony up $2~4k for it. Many devs/admins can contribute something on the hundreds, and a lot can contribute on the tens.

So, if there is any company willing to kickstart and develop a cPanel addon for this, it would be absolutely great. They can even charge a small monthly fee (but of course, the support would have to be solid).

what about Authy? https://www.authy.com/ I use it already for Bitcoin... WHM needs this!

I like it, but I do not want the solution to rely on cloud based solutions. Other options such as RSA SecurID, RADIUS Auth and others should be supported.

Sorry. For something as critical authentication, I want Cpanel to develop it themselves. Its not that hard to to RADIUS auth, Yubi auth .... I'm not paying extra for it myself and I'm not paying a third party monthly fee either.

We can protect our Gmail accounts with two factor authentication, and we can also protect our WordPress blogs with two factor authentication. It is now time for us to be able to protect our WHM and individual cpanels with two factor authentication.

Have you heard...

Internet vandals with 100,000 computers under their control are attempting to hack our WordPress sites 7 days per week, 24 hours per day, 365 days per year, and it is only a matter of time until they start working on our cpanels.

I talked to someone at cpanel and he thinks maybe the cpanel programmers might introduce two factor authentication in November of 2014. (With software development it is always hard to know when specific features might be introduced... It could be longer...)

The cpanel guy says that users like you and I can move two factor authentication along faster, if we work together and write comments in this thread and click the [LIKE This Feature Request] Button directly above these comments. So if you know anyone that cares about two factor authentication, sent them to this page. Nuff said.

I think offering several methods of two-tier auth would be a great thing. Each company running servers has a slightly different authentication setup now and already may have a two-tier setup for other systems (e.g. WHMCS how supports Duo Security, OATH and physical keys).

What I would like to see however is to enable specific types of authentication for certain accounts. Personally, I think initially I'd just want to protect the root account - that would include with WHM but also having the same two-tier setup on SSH etc. There's no point securing one without the other...

I don't feel for resellers/client accounts it's so important at present however. Sure it'd be nice, but it won't affedct the entire server and we have plenty of account backups. Not saying it wouldn't be good to be able to roll it out to them, but I think initially, I'd be really keen to see the root account protected.

Two factor authentication has been requested several times especially after an admin with a weak password got hacked on his test server.

Two factor via Google Authenticator would be great but another method would also be required for non smart-phone / tablet owners.

I even protect simple boards/WordPress websites with Google Authentication, so why not protect cPanel/WHM with it.

I would like to see OATH support. Once you have the app. configured on your ipod, iphone, etc. it works without need for internet connection. And for those without smartphones. Let cpanel generate lists of 10 auth codes at a time users can print out and put in their wallets. That is an easy option that should fit just about anyone's needs.

Please don't try and charge a monthly fee for something that is free, like others are doing! W*MCS

This would make security in cPanel much better than that of Plesk and other competing panels.

We would love this for our clients and staff. Please consider making this into development.

I've been thinking a bit about this. Two factor for WHM root user, yes, but for our company it would need to be optional for each customer, we would have it deactivated by default and allow each customer to activate it or not.

We would prefer it not to necssaraly go via Googla Authenticator, I think there should be a plugin system for this, cPanel should provide a Google plugin and allow others to make their own plug-ins.

Some might want to do the second auth by e-mail, others by a text message code, others might develop their own app, and some have this in their customers pannel.

I think there needs to be a default (maybe sending a 6 digit code my e-mail) and a plugin for Google Authenticator.

We would like this to be modular, let administrators decide what options customers have (choice between, None, E-mail, Google Auhenticator, Custom 1, Custom 2…) and a default.

We could then choose a fefault of None and allow E-mail, Google Auth. and Custom 1 and customers could decide which method they like best.

What would be rearly nice would be to also let customers decide which methods they want to allow, so they can have a main method and a secondary method in case their phone brakes down for example.

Two-factor authentication a necessity today.

We really need two-factor authentication for WHM and cPanel

logins, and if also possible, webmail.

We have deployed cPHulk Brute force protection and it shows tens

of hacking attempts to access root, cPanel and webmail!

Caphtcas reportedly annoy people but they protect them! I won't

mind them for WHM, cPanel logins and webmail

The additional security don't have to be "enabled" by

default. It can be user/admin selectable.

This will deal a death blow to brute force hacking attacks.

I also like the suggestion to optionally to 'require email

verification for every login', which is better than nothing.

I think Google Authenticator is the most popular solution : pratically everyone who is using two factor authentication is also using Google authenticator.

...i would strongly recommend going with this solution.

Our company secures almost everything else with yubikeys but WHM has fallen behind and is now a glaring security issue. We absolutely need this soon or we will be forced to leave cpanel behind.

Just to add, that I was initially not at all sure about this feature, but having tested it on dropbox, I must Google Authenticator is easy to use, easy to implement (thinking about giving our customers the option for our customers area…) and is compatible with all phones.

The idea of a 6 digit code that changes every couple of minutes is simple yet very effective and almost fun to use !

All companies that offer this security that I know of, so this on an optional basiss. Each user can choose to activate this functionality or not, depending on how much security they want.

I know some customers who like me would love to have this, while others would hate it.

For us, this needs to be a user based decision, for some hosts this might not be wanted and some might want this enforced.

Please make this feature an option that can be activated in WHM for either WHM only or WHM and cPanel, that you can set the default value (on or off) and that you can allow or disallow users to change the status.

We would have it off by default and allow users to turn it on.

Thanks

Two-Factor Authentication would be brilliant for sure. It increases security big time, especially in cases where people use the same password over multiple sites.

But yes, this should be OPTIONAL at all times. Not only optional for root, but also for clients. And agreed it should be free, instead of for example the WHMCS folks who figured it needs extra payment... cash cow 2.0.

It's *very* important this makes it in to cPanel asap.

All big companies are doing this now, Twitter, Dropbox, Gmail… :)

Google authenticator seems to be the closest to what everyone is using… either by fonctionality or by actually using it.

We will have optional two factor authentication for our new customers area so it seems important to have it also for the control pannel.

Lets get this rolling cPanel... I use two factor auth for every online service that supports it! cPanel servers are attacked and targeted all the time. The last thing any admin wants is to have their reputation ruined due to outdated authentication standards.

Lets see this in cPanel by December at the latest!

I'm with you guys, i'm in favor of it, but I just liked to add this comment.

Its very important featured

I've seen plenty of good, free and open source implementations of TFA lately. One noted example is a WP plugin called "Two Factor Auth" by "Oskar Hane". We have been recommending it to clients. It proves, there are plenty of simple ways to deal with those times where you forget your password, don't have your free to use cellphone or paid token device (or the charge is off your cellphone). Remember once setup, the token devices don't generally connect to the internet.

In this and other implementations, the author has three permanent one time panic codes, and a renewing One Time Password. So you can put the onetime only panic codes in your wallet (obfuscate!) or your safe (lol) and you'll always have those as the final resort. Then you can write down the current One Time Password that resets every time you use it. Maybe that should go in my wallet?

I have to have a list of these for client sites now. And i sometimes use them when I am in a panic. And then it has an email feature, where if you input your code wrong or don't have it, it sends the One Time Password to your email account of record. So you can mess-up, look at your email and use the One Time Password (it basically is a reminder service, feature), PLUS your regular password and you are in.

There is the ability and flexibility to choose your authentication algorithm and see your private key (secret) in text or base 32.

The user can choose to use a device/app Third party apps (Duo Mobile, Google Authenticator etc) or just the email feature (no device or app needed).

Once more it is an example of a creative, resourceful, free, flexible and useful implementation, completely opposite of implementations like WHMCS which is buggy, not free (even to use a free device and app which I do), not flexible enough to handle droves of real world, busy clients, with their own lifestyles and unnecessarily bent toward being a profit center rather than a real world solution.

I have no connection to the plugin, and am not endorsing it, but offer it because who doesn't spend a lot of time supporting WP installations these days, and I figure it is easy for others to checkout as compared to other implementations on more obscure platforms.

We would definitely support and vote for two factor authentication to be a key addition to WHM and for cPanel. The following would be our suggestions :

1) It should be an option to have it switched on by default for all users server wide and then also selectable whether it is forced on users or can be switched of by users via cPanel

2) It should also be an option whether it is forced on resellers and their users or not

3) While Google Authenticator is proven, there should be other options and a fantastic one that we are using and recommending to clients (especially those using WordPress) is Launchkey - http://www.launchkey.com simply uses a swipe key on a phone or tablet but which can also be configured to be multi-factor including geo fencing

We support and vote for this enhancement. We're implementing 2 factor authentication for all of our internal systems and for our clients optionally in WHMCS. Yubikey is our preferred method but any solid 2 factor authentication is better than none.

Actually, 2 factor authentication for something as critical and sensitive as cPanel shouldn't be viewed as a "feature request" or enhancement. It's become a requirement in today's world and I hope cPanel puts a much higher priority on this work soon.

Yubico.com<3

We use WHM/cPanel primarily where I work, and I go in to do all flavors of things to harden the server and our sites(most of us utilize YubiKey by Yubico). Having two-factor authentication for WHM will remedy the Achilles heel of our server and allow me to rest easy instead of watching the firewall terminate brute force attempts.

Agreed. This is a must-have for us soon. I actually am quite surprised that WHM doesn't yet have Two-factor. Looking forward to cPanel's excellence in this soon!

We're now looking into implementing Yubikey two factor authentication into as many of our systems as possible.

While Google Authenticator is good and better than not having two factor authentication and easy to use for customers for sysadmins yubikey seems an excelent choice.

I believe two factor authentication needs to be plugin based. Users need to be able to choose their two factor authentication system (none, google authenticator, yubikey, swekey…) as well a system to get around the two factor authentication (like a 100 character password or soemthing that is possible to do but too compicated to use on an every day basis).

This is something what must have every web application :)

From a security point of view, i'd say it would be better if client has to contact support at that point. Email reset isn't exactly the most secure thing around. :)

How long we will have to wait until this feature will be available.

The network can be dangerous place.

If someone downloaded a program thats kind of a keyloagger, the hacker can easily log into the owner's cpanel and do whatever he wants.

Its really dangerous, 2 factor authentication may prevent it.

Please cPanel, do offer us this feature!

It will make as hosting provider look more professional and acting to protect our customer's privacy and data.

There are currently two places where the root user can login, ssh and whm. SSH uses pubkey authentication which is secure enough, however for whm we have to run 40+ character passwords that we change regularly. If we had a yubikey two factor authentication for WHM we would feel much more secure.

Both User and cPanel owners, and workers can benefit from this! Yubico the best Two-Step verification company I have ever worked with has a team that can design a plug-in for cPanel and offer there products to cPanel customers that would love to own to secure there cPanels once and for all from hackers! They sale security keys along with there service that you simply plug-in to a usb port and simply touch a sensor button on it and it outputs the verification code without the need of a keyboard!

Absolutely want/need two-factor.

Already have several other accounts on Google Auth and a few on Authy. Prefer Google Auth. Would not want a third one that needs to be maintained.

Do NOT use text message. Unreliable/not functioning internationally. Can't use it on a plane etc.

Please, add soon.

Please add 2FA. This is a must have, and should be prioritized pretty high. Thanks.

Yes please. CSF does a nice job at blocking failed attempts but they just move on to another exploited computer that's not blocked.

SMS would be horrible idea. We use our Cpanel server in a data center environment where several people need access. The open source Google Authenticator would be perfect. Their app is available on all smartphone app stores and is free.

A MUST! Let's move on.

Please add a Google Authenticator - Two Factor Authentication or a Yubikey - Two Factor Authentication for WHM and CPanel, thanks.

Today it's very very important for the security of the Server and VPS.

Thanks in advance.

Google Auth NOW!!!

Yubico would be my choice for two factor authentication. Also Yubikey can be coded to auto logout the WHM admin user if the key is removed from the computer through the "Challenge response Ping" feature. Excellent feature to keep things secure in the office.

I had another customer ask me about this today. Customers are seeing easy to use two-factor authentication at places like Google and Facebook, and they are starting to understand how it makes things so much more secure. Then they wonder where it is for their hosting service. I'd really like to see this as an option for cPanel/WHM.

I am user of CPanel. I would love this security feature for cPanel/WHM as well as webmail authentication.

thanks.

Email authentication likely would not be ideal, as I know i login to cPanel/WHM from a mobile device quite often for quick changes.

Yubikey would be awesome, but you have to pay for that.

There is also Duo Security, but thats only free for 10 (maybe 5) users.

The best free option would indeed be Google Authenticator, but keep in mind not everyone has a google account, and I think this is required.

In the end, dual auth may (if implemented) end up being Opt In since you cant guarantee that everyone has a way to do dual auth.

Just food for thought. :)

You don't need a Google Account to use Google Authenticator. I am able to add Microsoft/Facebook/Dreamhost/etc into the application. Google Authenticator is built on a 2FA standard that doesn't require Google for anything. I currently have a Google Authenticator plugin installed in my WordPress that works great with the GA application but there are other apps that do the same thing. Actually, currently on my Android phone I use the Y Authenticator application with my YubiKey NEO that does that same exact 6 digit OTP generation. The nice thing about my NEO is that all I need is the Y Authenticator application and an NFC capable phone/tablet and have all of my OTPs. I can't believe how cPanel has totally dropped the ball on this since this discussion/feature request has been going on for over a year. There should not even be a question that this should be available for the WHM panel let alone the end user cPanel. A no one should be opting for the 2FA to be required, it should be opt-in. I could see a time where it could eventually be required as it becomes more of a standard, but in general the 2FA should have options for both SMS and Google Authenticator(i.e. code generator app).

http://solutionsfox.com/2012/06/google-authenticator-ssh-on-centos-6/

I'd like to see it implemented same methods as Gmail option and this week LinkedIn also implemented it:

http://www.slideshare.net/linkedin/two-step-verification-on-linked-in/1

It should be opt in by default , it should be able to be enforced or disabled by the whm root user and be pluggable so hosts can add all 2FA systems they want, google authenticator and yubikey being our two favorates. This should be made to work for both cpanel and whm access.

Users should also have the choice of all availble methods when they opt in.

Big fan of Yubico's YubiKey (with VIP for PayPal). CPanel needs to stop listening to this huge list of requests, and start doing something about it. All popular Open Source CMS's have done it.

To use Google Auth on a third party system, no Google Account is required. I vote in favour of this feature.

Yes Google Authenticator is must !!

This is insane how come! we don't have this two factor its a must option now days with so many vulnerabilities and exploit such heartbleed and stuff this option is must!

I suggest starting with the to most requested methods :

Google Authenticator

YubiKey

Keeping in mind that this should be pluggable so other methods could be added by third parties or added at a later time my cPanel if requested enough.

We would be glad to help out if required with the yubikey implementation as we have already implemented it in a few PHP projects. I'm quite sure yubikey themselves would also be pleased to see their hardware working with cPanel :)

I implemented Google Authenticator to MyBB in about a day.

You say it might be released in approximately 2 years.

I heard the Ajenti team is actually listening to it's customers, you should seriously consider doing the same or I'll be switching. Maybe it helps if I ask them to integrate GAuth and then recommend them to every single CPanel user I know (and I know quite a few, 40-50).

Google Authenticator and/or Yubikey, NOW. I can't believe I actually pay for this.

This would be a great security feature considering even if your root password is compromised they still have to have your random code, thus giving you time to see that someone has broken in and change your root pass and security settings before they download or damage anything.

Necesary for WHM / Admin & resellers atleast

The following plugin uses the cPanel Security Policy API

https://github.com/steadramon/cpanel_addon-twostepauth

Definitely would like to see this feature released.

Google Authenticator would be a definite want in terms of platforms supported.

Será muito útil!

Disagree

Would LOVE this on my system. Vote for the use of Google Auth

+1 for this

Please add this at least for WHM for a start, or at least for root WHM access for now. That part can probably be implemented very fast.

Google Auth, and Toopher should be the first two options, and you can extend it later with other account levels, service access and auth services, but this basic option for WHM root account should be implemented asap.

Not sure that toopher is the most known. I don't like the idea of not being able to login if my phone isn't charged and the two I've seen to be the most used are google authenticator and yubikey. We use yubikey because you can have multiple Keys so you always have access.

One important thing in the integration of 2FA is that it's important to be able to authorize multiple devises for a single user. That could be two phones and an ipad or 3 yubikey's

This two-factor authentication with one click was requested one year ago and tops the ranking of cPanel feature requests. Anybody from cPanel could update us about when this feature will be available? Many thanks.

It's minimum security requirements.

When it will be Implemented ?

This will be a great improvement to the overall server security! please implement it asap :)

Yes, I totally agree with such an implementation. We need some extra hours of sleep for godsake! :)

I tried to implement RV2Factor for WHM and cPanel but it wasn't the best of experiences. WHM part worked OK after LOTS and LOTS of efforts and after granting SSH and WHM access to their tech support (!!!) but the cPanel bit never worked as intended so I never launched it for my clients.

This needs to be implemented as soon as possible. Authy is a good alternative.

With all the web attacks, I am surprised they havn't done this yet.

COME ON cPANEL! It has been over a year since this request was published, and yet you still haven't even replied to this. Look at the facts:

1. There have been numerous vulnerabilities like Heartbleed, Goto FAIL, and the CCS Injection vulnerability which Two Factor Authentication helps provide extra security against.

2. Hundreds (maybe thousands) of websites already have support for Two Factor Authentication.

3. Major CMS and portals have support for Two Factor Authentication, like WordPress (which has many plugins for this), Joomla (which has Google Authenticatior built in), and Drupal.

4. One of your competitors (Parallels Plesk) ALREADY SUPPORTS TFA with Google Authenticatior and Clef under their extensions catalog. You can see this in their demo with the username admin and the password panel.

WAKE UP CPANEL!!!!

Let me just say I've received 67 emails TODAY about people ATTEMPTING to break into the WHM portion of the server. My server is pretty secure, but I just know two-factor authentication will ALMOST COMPLETELY eliminate this brute force garbage, and other hacking attempts!!!

Google Authentificator will be the best think for WHM access ! :-)

+1 would be a great security feature.

+1 using Google Authentifcator would be great too.

This here is a must! Where are Cpanel?

This is something we really need. Either though Duo Security or Google Authenticator would be great

Why use proprietary software and why lot of people supports Duo Security or Authy and stuff like that? There are many open alternatives that cPanel could use like LinOTP and make the same cPanel server or a central one an Auth solution instead of using 3rd parties for our security. So you trust your data on a 3rd party company that may shut down or change policy or anything else?

Bueler?

Where's cpanel at?

Any news !

I tried Googling this subject up and landed here. Hopefully this will be enabled soon. CloudFlare uses an app Authy that gives you a login code.

Regards, Doc

+1 for adding two-factor authentication options to cPanel — hopefully this is a no-brainer in light of the unending stream of breaches over the last 18 months.

Also, +1 for adding Clef as one of the 2FA options. After testing many of the options (Authenticator, Authy, Toopher, Verisign VIP, et al.), I found that Clef provides a simpler and more enjoyable 2FA user experience than token-based options:

• No passwords: Clef uses distributed PKI instead of passwords — it literally replaces passwords.
• No temporary codes: Clef does not require temporary codes, the use of which many users find to be cumbersome (e.g., racing against the timer to find the right code on the list [e.g., in Google Authenticator] and then to type the code before it expires, etc.)
• Single sign on and off with optional timed expiration: sign in once, and you are signed in everywhere; stay logged in indefinitely or until a set time; log out once and you are logged out everywhere.

Additionally, Clef seems to be gaining significant traction as a top-tier 2FA solution. For instance, Parallels Plesk recently added Clef as its preferred 2FA solution. Clef's WordPress plugin has become more popular than Google Authenticator's plugin, it is recommended by CloudFlare, and several top-tier hosts such as SiteGround, Raid Hosts, and 9th Node include Clef automatically with WordPress installs.(Note: I do not work for Clef or anyone else . . . just a webmaster/old hack who cares deeply about the security of my sites.)

PRECISAMOS URGENTEMENTE

This is a HUGE must for the WHM side of things and would be nice to also allow customers to decide if they want to use it. I would very much suggest using the Google Auth since it is the most widely used. :)

Two Authentication for a server is good. this will secure you from to be hacked and virus attack. you can access from different access thus will improve your website much better speed. get more example : http://www.results396.in/

Are we really facing a year old thread with over 400 votes? And still without any feedback from CPanel?

Cpanel does't give any feedback until a feature gets close to planning stages. If you look at the feature requests by popularity once everything that's planned is implemented we are left with 2FA, nginx, DNSSEC, incremental remote backups, so my guess is, judging on difficulty and popularity that 2FA could be one of the next large feature requests to make it to the planned stage. Wait and see...

I'd love for yubikey to also be an option for 2FA instead of just mobile app!

Please - 2 factor by Google auth

Google Auth Will do the trick for me! Please add it

Frankly I'm astonished cPanel.net is behind the curve with this one. So yeah, please add my vote.

Next I'm going to go over to GoodYear.com and vote for tires without inner tubes.

I came across this thread after searching for some form of two factor authentication I can implement on our sites WHM login. As an IT security analyst and someone who follows the headlines, I'm shocked this has not been implemented yet! This gets my vote!

It would be nice if it also supported yubico otp and/or u2f devices.

Has my vote too!

Another vote for 2FA. Duo Security and/or Yubico is needed. Having our cpanel's vulnerable like this is very bad.

I am truly astonished that this hasn't been enabled years ago, especially considering how many big time hacks go on and how important this software is to running a web server.

It would be really good to have this feature with twilio API. +1

This feature request is two years old... WHAT ARE YOU GUYS DOING besides ignoring this?

I just added tfa to a couple of Drupal sites, 10 minutes or so and it's working fine. I use SSH with key pairs, limit access to my IP, all kinds of stuff. Yet anyone from anywhere can attempt to brute force my main account on the server -- and of course this goes on all the time as others have noted.

Yes, definitely add TFA to the WHM / Cpanel accounts.

This is currently the second most popular requested feature and appears to have sat dormant for 2 years. I can see that implementing this would be a big job but it would bring very real benefits to whm/cpanel users.

Hopefully cpanel could at least provide a timeline for this feature. ???

Can't believe this is not a thing yet.

Hello,

I am investigating two-factor authentication. Would using a tool like Google Auth, that is already installed on many user's phones, be acceptable?

This would give no third party a direct access to a server. I have used Google Auth on my wordpress site, and find it simple and clean. Would that approach work?

I look forward to your feedback.

Hello Travis,

We don't use google auth because if your phone isn't charged or is in repair then you wouldn't have access. It's a good system just not adapted for companies as they don't all provide smart phones to their employees.

For us the rearly important one is yubikey. It's used by Google themselves and by other large companies. Yubikey's advantage is to allow multiple keys to be added and does't require a phone.

The most used free system is google auth, the most used paid system is yubikey. There are other that are popular such as clef, swiftkey etc.

Please make it so people can create their own plugins so each supplier can provide their own system.

My vote goes for both google auth and yubikey for the first version, implemented as plugins so it's easy to add other ones.

Yubikey is just as secure on the server side as google auth. You just submit the key to their servers and ask if it's valid or not. You still use normal password as well as 2factor so even if their servers were compromised one day it wouldn't give direct access to whm.

The server admin should be able to enable/disable 2fa auth methods and each user (whm or cPanel ) should have a list to choose from. If you have paid hardware then you will want to use that method, if you don't then you will want to use google auth.

Each user must then be allowed to associate more than one devices (multiple phones for google auth, multiple keys for yubikey) as it's important if one is lost or stolen to be able to log in with another one to disable the missing device.

Another point i've just thought about...

On the login page I think it's important to not hive any indication about a username or password being correct, so you can't show 2fa after submitting the username and or password, you should have a choice of available 2fa methods (none, google auth, Yubikey etc.) maybe just simple tabs befor submitting password... So that the user has to know which method his account uses. Yubikey and google auth both have a single text area, so if these are used they maybe you wouldn't need to select which one so it could just be an optional field without having to choose. But other systems might not have a field to fill in ? (Clef requires to generate a code bar that is scanned by a phone and swift keys auto allow logins without the user pressing on a button), not sure we would persoanly allow those two methods as to keep it simple, google auth (free) and yubikey (paid). No indication should be given as to why the login failed.

Taking into account how all 2fa systems work, just an optional 2fa field (with optional written clearly so new users don't think they have to put something there) should be ok. Systems that don't use it can just leave it empty (users without 2fa, swift keys, clef etc.)

This has a big +1 from me too - I would love to see 2FA on my WHM and cPanel accounts. I already use Google Authenticator (as do many others here), so this would be great.

Yes, please give us 2FA.

This is how I would do it.

Google Authenticator is perfect as you do not have to have a phone to also have access. There are desktop programs as well!

Hi Travis,

Any ETA on when this feature will be implemented? (I see the conversation has been going on for 2 years already...)

Many thanks in advance,

Frederic

Hi Frederic,

My Team is currently working on GreyListing to fight spam. We likely have another 3-4 weeks of development on that feature. After that we will be working on Two-Factor.

Thanks guys that's a great function we must have now a day for security. Very often I will ask my hosting company to make configuration for my server. If we turn on this two-factor might be a hard for them to access. I suggest we should have a whitelist of ip address (as an option) to login without the two-factor while other ip require to input the two-factor.

The growing number of attacks scares me even when using a huge random password and forcing TLS with strong ciphers!

Is really a must. Please, make this, all we needs most security!

Seen as this has been suggested two years ago, has cPanel implemented it?

I am all for 2 FA, and currently use the Google Authenticator app for nearly everything so would want to use it again.

I cannot believe this request has been sitting around for so long. My servers are hardened and firewalled and despite my active attempts at keeping it secure, a password was broken through brute force a couple of weeks back. All it took was this one incident and cp.php uploaded to destroy the security of one of my servers.

If two-factor was available, this would not have happened. I'm currently exploring other options in regards to hosting software solutions. Cpanel has let me down tremendously.

Google Authenticator does a good job!

https://www.twilio.com/blog/2013/04/add-two-factor-authentication-to-your-website-with-google-authenticator-and-twilio-sms.html

The Microsoft has also implement Google Authenticator into their website, so why cPanel does not?

I certainly agree with this request. However, I must stress that it needs to be a widely available system... Google Authenticator works perfectly for this.

Please for the love of god cpanel.

I just tried using RV2Factor which is a third party 2FA product and its a piece of CRAP.

Could not activate it and took them 4 days to answer a support ticket as I could not even get it working.It cant be THAT hard to put 2FA into Cpanel can it????

If you really want a kind of "two factor" support right now you should get a key like a Yubikey and program the second slot with a fixed strong password and use this as the second part of your password (as yubikey presses enter after writing the password).

It would be great to see Google Authenticator support (with SMS fallback) but I would be even better to see Yubikey support.

I am still gathering a bit more data for this feature, but the overall things I am hearing are:

Google Auth

Yubikey

If we provided these two as supported 2FA systems would that satisfy your requirements?

that would work for me... I use GA for almost anything - saves needing "yet another app...."

Yes, the Google Authenticator support would be fantastic. A majority of third party websites I use that offer 2FA integrate with Google and their 2FA API, so utilizing that would be ideal as it is already a common choice for 2FA.

That's really great, You can also review Authy .. That's good one

Yes, Google Authenticator is the mostly used authentication for many websites, and its easy to use. +1 here

+1 for Yubikey

Also a +1 for Yubikey from me :) Like it better than GA but it would still be great to have as many people use GA too.

+1 for Google Authenticator - easy to use, and I already use it for a bunch of other things, so it would be great for me!

+1 for GA, albeit Yubikey would be fine too!

Thanks.

GA and Yubikey are good however I would like to see one enterprise level option added also. Duo Security offers 10 free users and is quickly becoming the defacto standard in enterprises (mainly because of the ease of integration including into SSH protocols as well as other web applications) as well as the very user friendly feature of a push notification requesting approval as the second factor.

I think at minimum GA and Yubikey are good but I would REALLY like to see DuoSecurity supported as well (hey, if LastPass can support it then I am sure you can as well) and would provide a good option for enterprises as well as large shared hosting companies that wanted to implement enterprise level security to protect their shared hosting accounts.

Cheers,Stuart

What happen the update Generation?

Duo Security is enterprise grade security as mentioned above. The guys at Facebook and even Google Ventures/Google execs themselves use DuoSecuirty and invested money in the company. As well as NASA, tumbler and me. =)

https://www.duosecurity.com/success-stories/facebook

http://blogs.wsj.com/venturecapital/2012/02/28/google-ventures-backs-duo-security-to-fight-online-fraudsters/

Duo Security also supports TOTP passwords, Yubikey and other standards. Meaning users can use it for Google Authenticator TOTPS and add the Yubikey tokens. So its an ALL IN ONE and Free for 10 users.

SMS, Push. Iphone/Android and other mobile apps.

You can easily integrate Duo Security to CPANEL with their WEB SDK:

https://www.duosecurity.com/docs/duoweb

Client libraries are available for Python, Ruby, Classic ASP, ASP.NET, Java, PHP, Node.js, ColdFusion, and Perl.

Just my 2 cents.

Here is how we are going to implement 2FA to our Client Area :

1) Backup auth system : SMS and unblock code generation

2) Allow multiple devices, to be authorised : Google Auth, Yubikey (allow multiple Google Auth phones and multiple Yubikeys on a single acccount

3) Allow user to add IP's that don't require 2FA and manage per IP if an e-mail alert is sent for each IP when users logs in.

The two important things we request are :

Multiple devices/2FA systems per account.

Ability to quite easily add third party systems to allow other 2FA suppliers to write their own plugins and for webhosts to write their own custom plugins like sending mobile text messages, or having a button in their client area that gives the code unblock code.

- Google Authentication

- Yubikey

- DuoSecurity

This makes it possible to for everyone use the Two-Factor Authentication. Not only for those who like SmartPhones or External Devises. I have been using DuoSecurity for years already for simple UNIX root logins. This method enables phone call or SMS option for two-factor authentication. I strongly suggest to add ALL of these three options.

Below is a copy of my blog post contribution to this discussion over at my journal at:

http://www.leeteq.com/series/protecting-user-accounts/cpanel-whm-2fa-discussion-contribution-2015

***************

**This is an important strategic choice**

Generally speaking; Mobile solutions should not be the ONLY option.

(but practical as one of several options)

There are many scenarios and security considerations that requires that one can log in securely even (or especially) when the mobile network(s) are inaccessible, so a system that depends on that is by default a strategic problem, especially for server admins and (web)services. It is not an acceptable situation to introduce a solution that requires either mobile network availability or that the mobile phone is not lost/stolen/broken or its battery is dead.

For server platforms, it is also a question about how to deal with the responsibility for the security on mobile phones, if a 2FA solution is only dependent on the mobile device, which can be hacked.

*Remember; this is NOT just an end-user challenge for cPanel...**

This is not only a question of protecting a login, but also the very server or site administrator which may open up access to more than just one web site or cPanel account. IMO, server admins need to be able to enforce hardware based tokens for at least some of the accounts, and for this, both price, durability and form factor comes into the picture, in addition to the security architecture itself.

Some server scenarios also have the aspect of time criticality: There are situations when time is critical, and it would be unacceptable with unnecessary delays cause by mobile phone/battery problems, stolen/misplaced phones, or the like. It is also unpractical to keep extra/spare phones available as they would need to be charged/available, etc. There is a need for a solution that brings flexibility to the table.

A solution should also cater for using the same security token with several accounts, and enable blocking/temporarily disabling/enabling of such whenever some may be misplaced.

Below, I outline the flexibility that Yubikeys provides:

**Strategic elements for both cPanel.net and all of us:**

1. WHM and cPanel are strategic elements by nature. cPanel caters for the admins and business developers that serves services and solutions for the greater public. Today's most flexible example, Yubikeys, can be configured for (FIDO) U2F, Yubikey OTP, Symantec VIP, OATH-HOTP, OATH-TOTP, "Challenge-Response" / HMAC-SHA1, OpenPGP, Secure Element, CCID Smart Card...

2. The Yubikey server and software are Open Source (!)

Think about that for a moment:

- What does that open up of hyper-relevant possibilities for a PLATFORM like WHM/cPanel? We can for example bundle the Yubikey server as a Softaculous installation script, so that the key verification does not need to rely on (only) the Yubikey public server, but can be self-hosted inside cPanel...!

3. "Challenge-Response" mode:

- Yubikeys can be configured to use one of its slots/functions in "Challenge-response" mode, and the smallest version physically "disappears" into the USB slot and can stay there. Just touching its edge is enough to operate its two modes. That "Challenge-response" mode is also very relevant for server environments that can for example deal with (and enhance) the timeout of user logins by challenging the physical key without user invention, eliminating a huge annoyance for most admins and users. Combined with the fact that the server is Open Source software, this is significant. Combined with the physical form factor of the "nano" model, which does not stick out of the USB port at all, the convenience and practical value of this is significant.

4. Two-factor solutions based on SMS/Mobile phones are unnecessarily vulnerable, as they very prone to theft, loss, destruction, etc. Server solutions CANNOT be limited to something that becomes a show-stopper whenever the coffee happens to spill over the mobile phone (again), its battery just went dead (again), or its lost (again)... Yet it is practical to be able to have such mobile 2FA solutions as ONE OF SEVERAL options, which the Yubikey also provides.

5. Server solutions sometimes also need a physical, hardware (server-side, in-place) solution, which also should be supported.

6. Physical SSH login security with Yubikey + password (client-side) (need access to and physically press the Yubikey and provide a password. Even if network/router/connection is hacked, someone accessing the files on the client computer, copying its local private key file or the like, still cannot log in.

*****

**Practical insights regarding the Yubikey:**

(Why the Yubikey exactly? It just happens that right now the Yubikey is perhaps the most flexible, practical and affordable long-term example out there... Correct me if I am wrong, but from a server solution perspective, who else provides this flexibility, convenience and security, at such a low cost? )

- The Yubikey is a configurable, driver-less hardware USB token. It identifies as a normal USB KEYBOARD, which means there is NO need for software drivers on any computer or mobile phone.

- It is (VERY) small, cheap, water-proof and virtually indestructable.

- Yubico's Yubikey was the first major supplier to support the new 2FA standard from the global http://www.FIDOalliance.org (members: Paypal, Google, Microsoft, Alibaba, DuoSecurity, MasterCard, Visa, Samsung, Yubico, etc. See https://fidoalliance.org/membership/members/ )

- Yubikey can be (one of) your DuoSecurity token(s)

- Google Accounts (and Alipay in China) can be protected by Yubikeys through the supported FIDO standard. Google refers to this as a "Security key", without naming Yubikey specifically in the initial description.

- Paypal Accounts: The Yubikey VIP model can protect Paypal Accounts. Paypal supports the Symantec VIP (Versign Identity Protection) standard. This works in SOME countries, like US, Canada, UK, Germany and others (more are coming). (Paypal does not know or care about the Yubikey specifically, as long as it is a valid VIP code that is returned) This is a special model of the Yubikey, but as with most of the Yubikey models, it comes with 2 slots/(configurable)functions, so the normal Yubikey OTP is also there by default.

- It does NOT use/have a battery, which means it lasts MANY years.

TOTP limitation (side effect): services that use TOTP (Time-based OTP), must either use mobile apps like Google Authenticator or DuoSecurity in conjunction with the Yubikey to get the current time stamp (from the mobile phone clock), or install Yubico's own, free software on computers running Windows, Mac or Linux in order to interact with the Yubikey and get the current time from the computer clock.

(PS. This is NOT needed for the mentioned normal operations with OTP, Google Accounts, Paypal or the like.)

- Mobile apps: The Yubikey can be used with both DuoSecurity app, Google Authenticator, and more, both with the physical connection USB cable (standard+most Yubikeys), and NFC (see below)

- The latest Yubikey NEO model comes with NFC (Near Field Communication) support (wireless connection) that can be used with mobile phones (close proximity, no cables or physical connection necessary). This means that you can swipe the mobile phone over your pocket where your Yubikey is safe on your physical key chain or the like, without taking the Yubikey out of your pocket. Just swipe, and you get the code on the mobile screen. This can be an interactive two/three step process, or totally automatic, depending on the setup.

- The One-Time-Password (OTP) tokens are different each time, yet still identifies that particular Yubikey against either the free Yubico public server, or against your own implementation of that free, open-source server.

- You can install ready-made, open-source software on your Windows, Mac or Linux computer to use the Yubikey to also secure your computer account(s) logins. The software is managed at Github. (I _THINK_ all the clients are also open source (not only the server), not 100% sure about the Windows client though, haven't checked that (yet).

- We have used free, open-source Yubikey plugins/modules for CMS systems like Wordpress and Drupal for years. (which we use cPanel to host and administer...)

*****

**Recent Updates (April 2015):**

- Google just updated their Two-factor authentication interface and multi-account admin services, and it is now very convenient to use and administer Yubikey(s) for teams (read: FIDO-compliant Security Keys) to protect Google Accounts.

- Yubico just launched a new pricing scheme, both lowering the prices and also now avoids confusion and dilemmas by no longer pricing the ultra-small Nano model(s) separately. It just became easier to choose.

*****

**So:**

cPanel.net can certainly (help us all) kill more than one bird with this stone if you let this technology choice also be a (long term) strategic decision.

We should not a) be dependent on (only) mobiles, or b) have a situation where we are walking around with x bulky devices in our pockets, catering for a variety of proprietary services that does not support convenient global standards. It is far more practical to support a global standard that also lets end users have some freedom of choice as of which standard-compliant product they will use.

The FIDO path is here to solve this, and currently I would be both very pleased (seriously; anything for the better...) and (very) surprised to find anyone giving Yubkeys serious competition. (form factor, price, open-sourced server, etc.)

See more information about the global FIDO alliance here:

https://fidoalliance.org

Regards,

Leeteq XV :-)

I would encourage you to take a look at the SQRL protocol as well: https://www.grc.com/sqrl/sqrl.htm

PS. (a note to my previous post) The current FIDO standard does not currently offer solutions that address all concerns, though, so as far as I can see, making sure of NOT choosing solutions that can NOT be (also) used with Yubikeys, offers the greatest flexibility.

And, for example, consider the power of enabling easy installation/activation with configuration wizard of the open-source Yubikey server from inside WHM... How about reaching out to the Yubico devs at Github for a talk about the options?

I support this but would inquire as to how you'd handle having multiple administrators (support staff)

I support this but would inquire as to how you'd handle having multiple administrators (support staff)

Also, forgot to mention earlier, following on from what @bellwood said above, I think it is imperative that there are two levels considered for activating two factor authentication.

One is on the user side, for people using cPanel (and they should be able to activate it even if the hosting provider does not use it globally on the server). The other is on the WHM/admin side which needs to be configured separately (and quite distinctly from the user side).

I guess it would also be beneficial to have an overall setting which dictated to users that they have to use two factor authentication as well (when referring to the cPanel config specifically).

Also when looking at two factor I think Web Logins and SSH needs to be looked at as a minimum.

I must be up to my 6c or 8c by now... what can I say :D passionate about the topic.

Agreeing with @nerdzoll about the distinction between controlling 2FA for WHM and cPanel accounts, and also - or especially - about the ability (option) to enforce 2FA across the server (1) and ideally also on spedific/selected accounts.

I am also curious about the benefits of using DuoSecurity's services.

But for a general solution, I think that cPanel needs to avoid locking the solutions into anything that enforces cross-continent communication for such critical features.

With the ongoing surveillance debates etc., there are an increasing amount of clients outside the North American continent that will require that the authentication traffic does NOT involve "external" servers, and nowadays, in particular US services. Here in Europe for example, we need to be able to offer alternatives that ensures the whole communication happens within the EU. We have projects that even use this as part of building confidence these days: specifying that "no data leaves EU", as one of the points of sale.

I would think that cPanel dont want position themselves outside of this scope unnecessarily.

Does DuoSecurity have fully independent services on each continent? For the data, that is already being guaranteed by providers such as Google. I am not sure, but I think Google Authentication is either already offering that, or on its way to be enforced to do so by the legislative authorities in EU.

However, I both want to look for alternatives outside of their reach, and avoid locking into a webservice/vendor for the authentication. That is why Yubico is extra interesting, as they maintain an Open-Source, free authentication server that anybody can host themselves. That traffic does not even need to leave the server.

There is no conflict between Yubikey and DuoSecurity, though. They can happily co-exist and be used in tandem.

My point is just that I think that it is imperative to consider (optional) shipping with a built-in authentication server.

It should become easy as in a click-to-play to choose between DuoSecurity, Yubico Public Server, or Self-hosted Yubikey server, and get a standard installation and configuration options right out of the box.

Market potential / new services:

Obviously, here is also a potential new server security (co-)administration market potential. (Added managed hosting just for periodic security updates and security reviews for the self-hosted server.)

(Plus, technically speaking, it is not nice to be dependent on reaching out across the Atlantic (in this example) just to be allowed into a server whose whole operation is perhaps inside the European continent. It adds an unnecessary dependency on irrelevant parts of the internet backbone. Same goes for other continents. I think this is a valid concern.)

Keep in mind that 2fa is not only about technology but also management. In fact management is very hard thing especially when user lost their credential. For yubikey, it works for corporate where you know each other but not for hosting environment which most done remotely. It may work for 2fa for root SSH but not practical for cPanel user. And not easy if you outsource support to 3rd party vendor. How do you handle the hardware token distribution? And how to get the new one if you lost usb key, redistribution takes time. It is worst than mobile. On mobile, no need to distribute, you can download app right away. If user lost mobile, put it on the verification process in the same way as user request to change the password.

As I am only one here already implement 2fa on cpanel/whm. I would suggest you to think based on application by application. You cannot make it once for all services.

- Console; this is highest level. If 2fa is implemented here, you will need to find a way in case root is locked out.

- SSH; PAM is required. But manage credential on several severs is a nightmare. I would suggest you run secured box as a SSH gateway then configured it to passwordless access to the target server. And secured cPanel server by allowing only SSH gateway to access it.

- WHM, cPanel, webmail interface; cPanel already provide a mechanism to implement 2fa. It calls cPanel Security Policy Plugin since 11.28 (https://forums.cpanel.net/threads/new-feature-in-version-11-28-security-policy.169118/). There are free and paid cPanel plugin already implement 2fa through this.

For cPanel and webmail interface, it is quiet useless if you cannot secure FTP, POP3 and IMAP though.

- POP3, IMAP, FTP, Webdisk; don't bother on 2fa. Outlook, thunderbird, ftp clients, and etc. do not support it. But you should implement separate application specific password similar to GoogleApps ( https://support.google.com/mail/answer/1173270?hl=en)

PS: if cPanel want to built in support Symantec VIP, I can help you negotiate. According to the size of servers run cPanel, it will cost less than 0.8$/credential/month. Keep in mind that this is not per server, it is per person who activate the account. 1 credential can use for unlimited cPanel server.

*removed*

I don't get it, this is the second highest voted request on the site and it is not even in planned stage, let alone in progress? Come on cPanel, give your users what they are asking for.

I agree that this is URGENTLY needed. I also cannot help the impression that this is studiously ignored, due to unfathomable reasons.

Furthermore, at this point in time, any discussion of the technology used is pointless as long as Cpanel has not expressed its willingness to actually deploy 2-factor. I will gladly accept any 2-factor technology they finally use, while hoping that it is a widely accepted, and easily available technology.

It should be noted for those who are complaining about a visible lack of progress that cPanel have indicated that another feature request (Pluggable Authentication) is a prerequisite to 2FA systems. That feature is currently in progress and is aimed for 11.50

https://features.cpanel.net/topic/pluggable-authentication-pluggable-auth

I agree that this is URGENTLY needed. I also cannot help the impression that this is studiously ignored, due to unfathomable reasons.

Furthermore, at this point in time, any discussion of the technology used is pointless as long as Cpanel has not expressed its willingness to actually deploy 2-factor. I will gladly accept any 2-factor technology they finally use, while hoping that it is a widely accepted, and easily available technology.

Hi

Yubikey is good.

Google authenticator is ok but one of its downfalls is if your mobile is ever infected with malware the shared secrets used to generate OTPs can be stolen and an intruder could calculate a valid OTP for your accounts. Once PAM support is implemented it's going to be a game changer, as we'll then be able to use Yubikeys which supports both OTP as well as FIDO U2F.

This conversation is kind of timely for me since I'm expecting the delivery of a Yubikey Neo today :)

https://www.youtube.com/watch?v=CEwPP-h8Tzc

Obviously, Google Authenticator is an extra security level, but we cannot stay all time thinking in infected mobiles, infected computers, infected ....., I don´t Know how Yubikey works, it seem secure, but... ¿if computer is infected?, ¿maybe someone could get access to if a Yubikey is connected to the computer?

A second part is that hosting customers the won´t buy a Yubikey for accessing his cPanel, otherwise, Google Authenticator is free for them, and would be the way that they will want use it.

Don't get me wrong, I'm not saying the Google Authenticator doesn't provide extra security, it's just that storing your shared secrets on a hardware token's secure element is even safer, (i.e.: not susceptible to be phished). The goal of a secure element is to be a tamper-resistant platform which can store confidential data. For an example, Apple's iPay solution makes use of a secure element to contain sensitive information on the iPhone.

Also, it should be noted this isn't a single-use solution. The Yubikey also can be used to generate OTPs for multiple websites, it isn't dedicated to a single website.

https://www.youtube.com/watch?v=W7if0FW12D0

123

cPanel could move like WHMCS. WHMCS offers DuoSecurity and Yubikey for example. cPanel could do the same and offer a variety of solutions and let admins, resellers and users select what they like. They could use Yubikey, Google auth, Duosecurity and one other open source preferably solution to balance the list.

cPanel could move like WHMCS. WHMCS offers DuoSecurity and Yubikey for example. cPanel could do the same and offer a variety of solutions and let admins, resellers and users select what they like. They could use Yubikey, Google auth, Duosecurity and one other open source preferably solution to balance the list.

In reality Google authenticator is based on OATH and Yubikey supports the OATH standard. I'm not advocating for support of the Yubikey at the detriment of supporting people who use Google authenticator, I'm merely pointing out the Yubikey is just like Google authenticator but taking it to the next level. The Yubikey Neo supports:

- FIDO Alliances's U2F

- Verisign's OATH (Google authenticator)

- Yubico OTP (i.e.: any applications specifically designed to work with Yubikeys based on their own standard)

- Static password - you can pre-program a very long (think 30+ chars) password to be replayed.

2 years old and not even a statement ..

This suggestion is related to: https://features.cpanel.net/topic/two-factor-authentication-is-a-must

Chiming in on my opinion.

Personally if I choose today I would go with the Google authenticator method. Reason being is the app is free and supports all major smart phones. Most people already have a smart phone to use it on as well. There is no need to carry around a physical token either that could get lost.

YubiKeys are awesome yes but as some have stated, people don't want to spend the money to buy one. I've also had a problem where some computers don't seem to recognize it when plugged in. In fact it won't work for some reason on my home computer yet does on all my other computers (all running the same version of windows)

I have been using the Google authenticator on my Google account and other online accounts that offer if for years now. I also have a YubiKey tied to my Google account when they started offering it. It's nice that I can choose which to use when I log into my Google account.

I know for a fact that the Google authenticator is VERY easy to integrate. I've done it on some of my own personal web sites for testing. Took me maybe 15 minutes to do. I have since added it to my companies account management login systems.

P.S. Why not add support for both and just let the end user choose what they want to use?

Team cPanel........ consider about this

It's a must... definitely! Is there any update on this idea that has 2 years old already?

2 years!? I realise that there are other things I can do to restrict access to WHM, but TFA is such a simple solution, and it would be awesome to be able to offer this to customers too. Please consider this, for about 3 minutes, and then get coding :-)

2 years!? I realise that there are other things I can do to restrict access to WHM, but TFA is such a simple solution, and it would be awesome to be able to offer this to customers too. Please consider this, for about 3 minutes, and then get coding :-)

Any idea on whether this is feasible guys?

Personally I'm pretty sure it's feasible. I've added the open source Google auth to my company sites in about 30 minute time. Sure Cpanel will take more time, I understand that.

I've been using Cpanel for about 5 some years now. If I have learned anything from this, it's that Cpanel takes a LONG time to accept anything new (if they do) and then another 1-2 years to implement it.

I will still keep using Cpanel because it's the best choice for cost when it comes to a small hosting company. I have no gripes about it other than the over all system lacking key security features.

Sounds like a joke that you can safeguard you wordpress or joomla instance with 2-factor authentication and still, the applications that you pay serious money for cannot get this done? wow... how lame is that....

Totaly agree with you @Joe Doe.

PS. Even DirectAdmin has implanted Two-factor Authentication in the last build

2FA! +1

I honestly CANNOT believe that cPanel hasn't incorporated this in to their software! cPanel is a worldwide platform. so many other small companies are using it. even Joomla which is open source!!!! Come on man!! pull your socks up now!

GOod point, I like your article and will be back soon, .

PLEASE AND THANK YOU. I truly need this feature.

I agree,

I use 2 factor authentication for everything, including my Gmail, and Hotmail accounts.

I honestly don't understand how cPanel havent included this, especially given that sites can get hacked etc.

I agree,

I use 2 factor authentication for everything, including my Gmail, and Hotmail accounts.

I honestly don't understand how cPanel havent included this, especially given that sites can get hacked etc.

Since the last 5 years I see 80% more cPHulk attacks in the log file. Primary from China and Russia.

I have 3 times a break-ins in the last 6 months. Hackers has send SPAM over two user email accounts and the cPanel support cannot help me to locate the break-ins!!

With so a security relevant thing, like a server administration software is a two factor authentification a "must have"!

It is time, that cPanel build in a two factor authentification with a USB dongle or with "Google Authenticator" over a mobile phone.

In Joomla, Gmail, Facebook, Yahoo & co. and the biggest banks is two two factor authentification already included.

https://blog.sucuri.net/2013/09/big-increase-in-distributed-brute-force-attacks-against-joomla-websites.html

https://www.mattcutts.com/blog/google-two-step-authentication/

Please build in the feature.

Moderator: using our feature request site to promote your own product(s) is not allowed.

Great news that this is now planned. After a few years of cPanel seeming to be slow adding new features requested on here, it now seems that you are accepting and adding a lot more just recently - thanks !

Its about time they set it to planned! Thank you

Great news that this is now planned. After a few years of cPanel seeming to be slow adding new features requested on here, it now seems that you are accepting and adding a lot more just recently - thanks !

Fantastic news. Whats is the estimated time of production?

Thanks

FANTASTIC NEWS

Thanks

Which Implementation of 2FA ? There are many. It will be also available for other services like ssh?