How to deactivate 2FA

[Flooxou]

Hello,
Now with the new version of Teleport, it is possible to disable the 2FA. But I have the impression that it is not done as before version 16. Is it possible to document how the deactivate? and is it possible to do it with teleport as a package or do you need the docker version?

[webvictim]

You need to set the TELEPORT_ALLOW_NO_SECOND_FACTOR environment variable to yes, then restart Teleport.

Assuming you're running Teleport with systemd, this is most easily done like this:

echo "TELEPORT_ALLOW_NO_SECOND_FACTOR=yes" | sudo tee -a /etc/default/teleport
sudo systemctl restart teleport

For Kubernetes-based deployments using the teleport-cluster Helm chart, you'll need to add it to your chart values and then helm upgrade:

extraEnv:
- name: TELEPORT_ALLOW_NO_SECOND_FACTOR
  value: yes

[Flooxou]

I tried this method but when I restart teleport, I always need to do the 2FA. Even if I try to create a new user. I am in version 17.0.3 however.

[zmb3]

It should work in version 17.0.3.

You'll need to set the env var and set second_factor: off in your configuration.

• Teleport 15 and earlier allow you to disable MFA without setting any env var.
• Teleport 16 requires you to set TELEPORT_ALLOW_NO_SECOND_FACTOR=yes in order to disable MFA.
• Teleport 17.0.1-17.0.2 provide no way to disable MFA.
• Teleport 17.0.3 restores the Teleport 16 behavior.

[Flooxou]

Ahhhh thank you, I hadn't put second_factor: off.