> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/installation-and-configuration/installation-and-configuration/additional-configurations/two-factor-authentication.md).

# Two-Factor Authentication

To increase the security of your Enginsight instance, you should enable two-factor authentication. In the following, we will show you which steps you need to take.

{% hint style="warning" %}
**Please note:** Before you enable two-factor authentication in your productive environment, you should [configure and test your mail server](/docs/manual/english/installation-and-configuration/installation-and-configuration/additional-configurations/mail-server-configuration.md) so that the Enginsight platform can send email notifications.
{% endhint %}

***

## Configuring and Enabling Two-Factor Authentication

{% stepper %}
{% step %}
Log in to the Enginsight Application Server if you have not already done so.

You can do this either directly through the console of your Application Server VM or remotely via SSH (Secure Shell) from a different machine.
{% endstep %}

{% step %}
Open the Enginsight configuration file using the following command:

```
sudo nano /opt/enginsight/enterprise/conf/services/config.json
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Navigate to the `twoFactor` section and adjust it as follows:

```
"twoFactor": {
      "enabled": true
    }
```

{% endstep %}

{% step %}
Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
You must now run the Application Server setup script again to apply your changes.

Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Run the setup script anew using the following command and confirm all prompts by pressing **Enter**:

```
sudo ./setup.sh
```

{% endstep %}

{% step %}
After running the setup script again, important functions within the Enginsight platform are now protected by two-factor authentication.

The second factor used depends on the information configured under **Settings** → [User Account](/docs/manual/english/administration/settings/user-account.md) and **Settings** → [Multi-Factor Authentication](/docs/manual/english/administration/settings/multi-factor-authentication.md):

* **Email address configured:** An authentication code is sent to the specified email address.
* **Mobile phone number configured:** An authentication code is sent via SMS to the specified mobile phone number.
* **Authenticator app configured:** An authentication code is generated by the [configured authenticator app](/docs/manual/english/administration/settings/multi-factor-authentication.md#multi-faktor-authentifizierung-hinzufugen).
* **Mobile phone number configured and authenticator app configured:** An authentication code is sent via SMS to the specified mobile phone number, and an authentication code is generated by the configured authenticator app.
  {% endstep %}

{% step %}
If you would also like to require two-factor authentication when signing in to the Enginsight platform, follow these steps:

#### Option 1: Individual User Account

1. Log in to the Enginsight platform and navigate to **Settings** → **User Account**.
2. Expand the **Advanced Settings** section.
3. Enable the **Two-Factor Authentication at Login** toggle.
4. Click **Save Changes**.

#### Option 2: All Team Members

1. Log in to the Enginsight platform and navigate to **Settings** → **Organization**.
2. Expand the **Advanced Settings** section.
3. Enable the **Two-Factor Authentication for All Team Members** toggle.
4. Click **Save Changes**.
   {% endstep %}
   {% endstepper %}

***

## Optional: Increasing the Validity Period

If you want to increase the validity period of authentication codes used for two-factor authentication, you can do so through the Enginsight configuration file.

{% hint style="info" %}
The default validity period of an authentication code is **30 seconds**.
{% endhint %}

{% stepper %}
{% step %}
Open the Enginsight configuration file using the following command:

```
sudo nano /opt/enginsight/enterprise/conf/services/config.json
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Navigate to the `twoFactor` section and adjust it as follows:

```
"twoFactor": {
  "enabled": true,
  "authenticatorWindow": <Number>
}
```

{% hint style="info" %}
Remember to replace `<Number>` with the desired value.
{% endhint %}

The validity period is calculated using the **following formula**:

`30 seconds × <Number> = validity period in seconds`

For example, if you want an authentication code to remain valid for **2 minutes**, set `<Number>` to **4**: (30 seconds x 4 = 120 seconds = 2 minutes).
{% endstep %}

{% step %}
Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
You must now run the Application Server setup script again to apply your changes.

Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Run the setup script anew using the following command and confirm all prompts by pressing **Enter**:

```
sudo ./setup.sh
```

{% endstep %}
{% endstepper %}

***