Setting up multifactor authentication for administrators using command line administrative client

Edit online

You can set up multifactor authentication (MFA) on an administrator account by using the command line administrative client.

Before you begin

The following requirements must be met to set up multifactor authentication on an administrator account:
  • The administrator must sign on using a command line administrative client 8.1.2 or higher.
  • The administrator account must be configured to use SSL sessions between the server and the administrator.
Tip: Use the QUERY ADMIN command with the MFAREQUIRED=YES parameter to list administrators that are configured to use MFA. Use the QUERY ADMIN command with the MFAREQUIRED=NO parameter to list administrators that are not configured to use MFA.

Procedure

To set up multifactor authentication on an IBM Storage Protect server administrator account by using the command line administrative client, complete the following steps:

  1. Sign on to the IBM Storage Protect server by using the command line administrative client, specifying your password at the password prompt.
  2. Specify the MFAREQUIRED parameter to YES by using one of the following commands:
    • REGISTER ADMIN: To enable MFA while registering an administrator account for the first time.
    • UPDATE ADMIN: To enable MFA on an existing administrator account.

    With this step, the Multifactor Authentication Required state parameter is set to the TRANSITIONAL value. In this state, the administrators can use their password only to sign on to the account. To issue any administrative commands, you must complete the rest of the procedure.

  3. Sign on to the server by using the command line administrative client, specifying the administrative ID and password that is being configured.
  4. Issue the GENERATE SECRET command to generate a shared secret for an administrator account. The GENERATE SECRET command generates a base32 encoded string.
  5. Specify the base32 encoded string in an RFC 6238 supported security application that generates a time-based one-time password (TOTP) setup on the administrator's mobile device or workstation.

    Also, specify the following parameters, if required by the application:

    • Code Generation: Time based
    • Algorithm: SHA1
    • Period: 30 seconds
    • Digits: 6
    Note: The time that is displayed on the administrator's mobile device or workstation, where the security application is installed, must be in synchronization with the server time.
    Tip: Some of the supported security applications are as follows:
    • IBM® Verify
    • Duo Mobile
    • Google Authenticate
    • Microsoft Authenticator
  6. Sign on to the server by using the command line administrative client, specifying the username, password, and TOTP. The TOTP is appended at the end of the password. 
    dsmadmc -id=admin -password=<adminpwd><authentication_token>

Results

After the MFA is successfully set up for the administrator, the Multifactor Authentication Required state parameter is set to STRICT. For all subsequent sessions, the administrator must sign on with the password and the TOTP.