XOOPS 2.7.4 Beta 2 — two-factor authentication (2FA) comes to the core

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 Beta 2. The headline feature is two-factor authentication (2FA) built into the core: every member can protect their account with a second step at login, using an authenticator app or a code sent by e-mail. This is a beta for testing; please try it on a staging copy of your site and report what you find.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Ten one-time recovery codes at enrolment, for the day the phone or the mailbox is out of reach
* Five wrong codes lock the second step for fifteen minutes; the member is notified by e-mail
* Remember-me cookies are bound to the enrolled factor, so a reset invalidates them
* Members manage everything themselves from Edit Account, including disabling and replacing recovery codes
* Administrators reset a member's factor from Users, and an operator locked out of the site has a documented escape hatch
* Off by default. Switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Secrets are encrypted at rest with a site key; mailed codes are stored hashed and expire after ten minutes

Also in this beta

* The login flow was split into reusable pieces, and every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor
* Account deletion removes the member's tokens and factor row, and no longer fails half-way
* A MySQL integration job now runs the concurrency and installed-site tests on PHP 8.2 through 8.5 on every change

Upgrading from 2.7.3

Copy the new htdocs/ files over the web root and run the upgrade wizard; it creates the user_2fa table and the new preference. Two-factor needs the PHP sodium extension, which the wizard checks for. No mainfile.php changes are needed. Operations notes: docs/2fa-operations.md in the package.

System requirements

PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the sodium extension for two-factor authentication.

Thank you to everyone testing the betas. Report issues at https://github.com/XOOPS/XoopsCore27/issues

---------------------------------------------------------------------

Using two-factor authentication for the first time

Two-factor authentication (2FA) adds a second step to your login: after your password, you enter a short code that only you can produce. Someone who learns your password still cannot get in. Setting it up takes about two minutes.

Before you start

Decide how you want to receive the second step:
* Authenticator app (recommended): an app on your phone or computer shows a new six-digit code every 30 seconds, even offline. If you have none yet, install one first, for example Google Authenticator, Microsoft Authenticator, Aegis or FreeOTP. Most password managers can do this too.
* E-mail codes: the site mails you a six-digit code each time you sign in. Easiest to start with, but anyone who can read your mailbox can pass this step.

Step 1 — open the setup page

Sign in, open Edit Account and click Two-factor authentication. You can also go straight to user.php?op=2fa_manage.

Step 2 — choose your method

Enter your current password, then click either Set up an authenticator or Use e-mail codes.

Step 3a — authenticator app

1. In your app, add an account: scan the QR code shown on the page, or choose manual entry and type the setup key printed under it.
2. The app now shows a six-digit code. Type the code it shows right now into the field and click Confirm authenticator.

Step 3b — e-mail codes

1. Check your inbox (and the spam folder) for a message from the site with a six-digit code. It is valid for ten minutes; Send me a code requests a fresh one.
2. Type the code into the field and click Confirm e-mail codes.

Step 4 — save your recovery codes

The page now shows ten recovery codes. Save them somewhere safe, separate from this account: a password manager or a printed sheet. Each code works once, and they are shown only this one time. They are your way in if your phone is lost or your mailbox is unreachable.

Signing in from now on

Enter your username and password as usual. On the next page, enter the current code from your app, or the code the site just mailed you. If you cannot produce a code, open Use a recovery code instead and enter one of your saved codes; the site e-mails you when a recovery code is used.

Good to know

* Five wrong codes lock the second step for fifteen minutes. A recovery code still works during the lock.
* "Remember me" is not available for accounts with two-factor authentication.
* To turn it off or to replace your recovery codes, return to the setup page: it asks for your password and a code.
* Lost everything, phone and recovery codes? Ask a site administrator, who can reset your two-factor authentication from the users admin. You will need to set it up again afterwards.