Identity and access
Two-factor sign-in, step-up confirmation, roles and least privilege, sessions and lockouts across the SENTRA consoles.
Two-factor sign-in#
| Console | Two-factor (TOTP) |
|---|---|
| Licensing Authority | Always required: set up at the first sign-in, can't be skipped; eight one-time recovery codes |
| SENTRA VIEW, SENTRA GUARD | Available to every user; the security policy can require it for all staff |
| ATS and NTS | Available to every user; a GUARD's policy can require it for the users it manages on its boxes |
Codes follow RFC 6238 (30-second steps) and each code is accepted once.
Step-up confirmation#
In the Licensing Authority, revealing keys, downloading key bundles, approving licences and releases, managing keys, users and policy need a fresh two-factor code, valid for a few minutes, even inside a signed-in session.
Roles and least privilege#
- Every console has roles with explicit permissions; administrators can build their own roles in ATS, NTS, GUARD and VIEW. Built-in top-level administrator roles can't be removed or weakened, and the last top-level administrator can't be removed.
- A user who manages other users can't make anyone a top-level administrator or change a top-level administrator's account.
- In the Licensing Authority, per-user limits restrict which kinds of licence each person may issue, for how long, whether perpetual, and for how many systems; four-eyes approval separates requesting from approving.
- On boxes managed by a GUARD, the GUARD distributes its users (password hashes and 2FA secrets, only for the boxes each user may reach) and can switch local accounts off; one emergency glass-break account works only while the GUARD can't be reached.
Sessions and sign-in protection#
- Passwords are stored only as salted, deliberately slow hashes: scrypt in the Licensing Authority, PBKDF2-SHA256 with 200,000 iterations in ATS and NTS, PBKDF2 in GUARD and VIEW. Minimum lengths and complexity rules apply.
- Sign-in attempts are limited with lockouts and rate limits; in the Licensing Authority unknown users and wrong passwords get identical answers.
- Console session cookies in the Licensing Authority, ATS and NTS are
HttpOnlyandSameSite=Strict, andSecureover HTTPS. In the Licensing Authority every change also needs a per-session CSRF token, cross-site requests are refused, and idle and absolute session time-outs apply. - The Licensing Authority keeps sessions only in memory and can restrict its console to listed networks.