Setting up multifactor authentication across a network of servers

Edit online

You can set up multifactor authentication (MFA) across a network of servers to ensure an additional layer of protection for your account in the IBM Storage Protect server.

Before you begin

To manage a network of servers, you must ensure the following:
  • Your account must have administrative privilege.

About this task

You can manage a network of servers with MFA set up on your account.
Important: Configuring MFA on your account impacts the following features:
  • server-to-server command routing
  • server-to-server export/import
  • PING SERVER command

Procedure

To set up MFA across a network of servers, complete the following steps:

  1. Set up each of the servers within the network with the same password.
  2. Configure MFA on each server within the network. See Setting up multifactor authentication for administrators for instructions.
  3. Specify the same shared secret on all the servers within the network by referring to any one of the following practices: .
    • Use Enterprise Configuration to synchronize the MFAREQUIRED setting across all servers in a network.
      Tip: You can issue the NOTIFY SUBSCRIBERS command on a configuration manager to synchronize its MFA settings with one or more managed servers.
    • Issue the EXPORT ADMIN and IMPORT ADMIN commands to export and import an administrator account's MFAREQUIRED setting and the shared secret, from one server to another server, respectively.
      Tip: Specify the REPLACEDEFS=YES parameter to apply the settings for an existing administrator account on the importing server.
    • Specify the shared secret manually while registering a new administrator or configuring an existing administrator to use MFA.
    Important: To manually specify the shared secret, complete the following steps:
    1. Issue the GENERATE SECRET command on one server in the network to generate a base32 encoded shared secret.
    2. Issue the REGISTER ADMIN or UPDATE ADMIN command with the MFAREQUIRED=YES and SHAREDSECRET= <base32 encoded shared secret > parameter on the other servers in the network.