FreeCORE Documentation freecore.org

Using Console Login OTP

Provides instructions on requiring a one-time password at local and serial console logins.

FreeCORE can require a one-time password (TOTP) at local console logins, in addition to the account password. This covers the physical console, the serial console, and out-of-band virtual consoles (IPMI/iDRAC). It uses the same TOTP secret as two-factor authentication for SSH and the web interface.

Enabling

  1. Enable two-factor authentication in System > 2FA and register the secret in an authenticator app.
  2. Make sure Show Text Console without Password Prompt is disabled in System > Advanced. While the passwordless console menu is active, the console bypasses login entirely, so the system refuses to enable console OTP (and refuses to re-enable the passwordless menu while console OTP is enforced).
  3. In System > 2FA, select Enable Two-Factor Auth for Console and save.

Console logins then prompt for the password followed by a one-time code. SSH two-factor behavior is unchanged by this option.

Recovery

If OTP access is lost, boot into single-user mode from the physical console and disable two-factor authentication from there. Console OTP protects against walk-up access to a logged-out console; it does not defend against an attacker with full physical control of the machine.