Enabling two-factor authentication prevents us from logging in by ssh?

[nanashi]

I configured my FortiGate with the CLI command as below:

---

config system admin

edit admin

set two-factor email

---

Does this affect ssh log-in?

If so, is there any solution to divide ssh authentication and http authentication?

thank you,

[pminarik]

Admin authentication is shared across all login methods - HTTP/S, SSH, Telnet. It is not possible to disable 2FA for one login method specifically.

The only exception is protocol-specific authentication (x509 certificate for admin GUI login via HTTPS, SSH keys for SSH login).

If you add email 2FA to your admin account, the token will be mandatory for SSH as well. So be careful with this, if all your admins are email-token-enabled, they likely won't be able to log in if the FortiGate goes offline for any reason. :)

[sjoshi]

Hi nanashi,

You should be getting the token in your email even for ssh access.

You can enter the token received in your email and post that the login will be allowed