2FA broken since the update

[jke]

Hi,

I've analyzed the issue today and it was not related to OpnSense.

The NTP daemon on my Admin Workstation stopped for what ever reasons and due to that the time was out of sync.

br

Hi Mks,
in my case, this isn't the problem.
But i just figured out it may be the "daylight savings time", which seemingly isn't handled correctly by the OPNsense.
In the logs i can see the the timestamp of current actions with my time -1 hour.
Do you know if that could be the problem for the faulty OTP-token?

Also, if this is really the problem, can someone explain, why it just happens with version >=25.1?

[petrus]

Hi!
Not sure what's wrong, but 2FA stopped working since the update to 25.1 for me too. I'm using Google Authenticator, and it still works for every other login.

[meyergru]

The usual cause is that the system time is off for whatever reason. 2FA generally works fine with 25.1.x.

[petrus]

Hi!

Thanks, but system time was definitely not off.
I got in via console into my box and verified the system time was correct to a second. Veirfied ntp with ntpq -p, it has shown many reachable peers. Then I rebooted. 2FA still did not work. Updated from 25.1.2 to 25.1.3. Still no login possible, until I used "opnsense-shell password" to reset password and auth to local database.

Something is fishy.

Peter

[passeri]

Set up 2FA from scratch again, in trial mode only. See whether that testing works on a new instance. If clocks are right on both devices then the code string is wrong on one or the code is at the wrong end. I am not actually suggesting you got the latter wrong, it is just a remaining available cause.

I have had no problems at all with 2FA through upgrades from 24.7 to 25.1.3.

[petrus]

Thanks for your time and your tests Passeri! It´s a possibility of course, that I got the "code string" wrong and I´m sure I did it wrong several times. I´m also sure though, that despite my lacking typing capabilities, I got it right some times. :) 
I will set 2FA up again this evening and do some further testing.