SCC Two-factor Authentication with Duo Security

As of March 15, 2021, all SCC users, including Linux Virtual Lab/scc-lite users, need to use Duo two-factor authentication in order to connect to any SCC system (scc1, scc2, geo, scc4, and scc-lite). SCC OnDemand users were required to use Duo before that date.

Duo is the same technology used to authenticate for the Student Link, Faculty Link, and BUworks so almost all BU people should already have used it. If you do have it, then accessing the SCC using Duo two-factor authentication should be fairly familiar and straightforward. If you have never used Duo (mostly external collaborators using the SCC), you should go to SCC OnDemand and, once you have authenticated with your BU login and Kerberos password, you should be given the option to enroll in Duo (see example image). You can also consult this page which has instruction on enrolling devices such as smartphones, landlines, and tablets into Duo to allow you to use them for authentication but use SCC OnDemand as your way to test it since you may very well not have access to BUworks and some of the other example services; Duo is available for ALL SCC users. See the other questions on this page about the specifics of connecting to the SCC using Duo two-factor authentication.

You are required to use Duo as a second method of authentication when logging into any SCC machine. Individuals are asked to confirm their identity using a smartphone app, via text message to a device, or via automated calls to a mobile or landline phone.

The screenshot below shows the process of logging in to scc3/geo using Duo with MobaXTerm for Windows. After you enter your BU Kerberos password, you will be prompted by Duo to use one of the authentication methods that you have previously set up. Only after having done that second authentication will you be logged in to the SCC.

The first time you connect to any SCC login node (scc1, scc2, geo, scc4, or scc-lite) using an SSH client or a file transfer application, you will be required to use Duo two-factor authentication. Once you have done that, if you initiate further connections from the same source computer (with the same IP address) to the same SCC login node, you will not need to use the second Duo factor for 30 days. This is true even for different programs, so if you connect to scc1.bu.edu using an SSH client and authenticate with both your password and Duo you will then, for 30 days, be able to connect to scc1.bu.edu using a file transfer application and only need to supply your password.

As stated above, the IP address must remain the same. If you were working on your laptop using wireless at home and then switch to using the BU wireless, for example, you will need to authenticate again with Duo two-factor authentication.

No, Duo two-factor authentication only ever applies when you log in to the system/open a file transfer connection. You can stay logged in/let your file transfer run for as long as you want without an issue.

If you don’t need a password, you also don’t need Duo two-factor authentication. One example of this is connecting from one SCC node, say scc1.bu.edu, to another SCC node, such as scc4.bu.edu. However, you may have things set up so that you are being asked for a password but your SSH client or another program is automatically remembering it and supplying it; in these cases, you may still need to use Duo two-factor authentication.

Yes, although the two systems are using the same technology, the implementations are totally independent. Authenticating to one of them has no effect on the other one.

No, Duo should work fine regardless of where you are connecting from and for all SSH clients and file transfer applications. Please let us know if it is not working for you, particularly if you are using it from a foreign country or are using a new application to access the SCC. Please provide as much detail as possible on what your situation is.

No, Research Computing Services does not lock SCC accounts based on failed attempts at authentication.

There are issues with Duo TFA when using the Terminal method of connecting using MobaXterm. We recommend switching to using ‘Sessions’ as described under Connecting to the SCC from Microsoft Windows.

Alternatively, you can continue to use the Terminal method with the following command line argument:

ssh your_login_name@scc1.bu.edu -o PasswordAuthentication=no

There are issues with Duo TFA when using the ‘Quickconnect’ method of connecting to the SCC using File Zilla from the opening screen. You should instead create a ‘Site’ by doing the following steps:

1. Open Site Manager with File > Site Manager.
   
2. Single-click the name of your SCC site on the left. Change the Logon Type to “Interactive.”
   
3. Click Connect. A box will appear to ask for your password. Enter your BU Kerberos password and click OK.
4. A new box will let you choose a way to respond with Duo. This should be familiar to you from other applications. Respond to the challenge and FileZilla will connect.
   
5. When you connect to the SCC from the same computer in the next 30 days, it will prompt for a password with the same type of box but it should not present a Duo challenge. This only applies if you are connecting from the same machine to the same SCC node and you are using the same IP address.

Yes, you are very much encouraged to set up Duo on more than one phone in case you forget a phone at home or are not at your office phone. When you are doing your initial setup (or are adding devices later), you may add as many phones as you like (landline and/or mobile). After that, when you are logging in you can choose which line Duo will send the authentication request to (via smart phone app, SMS text message, or phone call depending on what you chose).

Yes, you can use the Manage Devices feature to add, remove, or change the devices that Duo can use to verify who you are.

If you get a new phone, even if the Duo app is restored from a cloud backup, it will lose its association with your account. If the phone number of your new phone is the same, you can still authenticate using the phone call or sms option, but the push option will not work until re-activated.

You can re-activate your new phone with the Manage Devices option. First, ensure that you still have access to any of the phone numbers enrolled in Duo. Set the authentication option to Phone Call and then select Manage devices. The phone you chose should ring, and you will need to answer, and hit any key to authenticate. From here, you can select the phone number of your new phone (assuming it’s the same phone number) and under Actions, select Activate Duo Mobile. This will prompt you to scan in a new QR code from the Duo app. If you have difficulties with this process, you can submit a ticket to the IT Help Center or call for immediate assistance – 617-353-HELP (4357).

The Duo smart phone app is designed to work internationally. If you install the app, it can generate the required code without need of either a telephone signal or data plan, and it can do this anywhere in the world. If you have a signal and data plan, the app makes two-factor authentication as easy as pushing a single button, but if you don’t have one of those two things, you can use the app to generate a six digit code and enter that manually.

You can contact the IT Help Center. They will verify your identity and provide a temporary passcode. We encourage you to then go into Manage Devices and add an additional phone.

Contact the IT Help Center immediately and we will lock your Duo account to prevent malicious activity.

If you don’t have a cell phone, Duo allows you to use your landline phone. You would receive an automated phone call that requires you to hit any button to confirm your identity.

The Duo smart phone app provides options that work without a data plan, a texting plan or even a connection, if necessary. The app can generate the required code without need of either a telephone signal or data plan, and it can do so anywhere in the world. If you have a signal and data plan, the app makes two-factor authentication as easy as a pushing a single button, but if you don’t, you can use the app to generate a six digit code and enter that instead.

No. Duo provides a great deal of flexibility and you do not need a smart phone to use it.

The recommended smart mobile phone option makes two-factor authentication extremely easy, but a lot of other easy options exist as well. Duo can send a text message to a regular cell phone or place a voice call to your office landline phone or cell phone.