Bubka/2FAuth
2FAuth
2FAuth is a self-hosted two-factor authentication server and credential vault. It functions as a web-based authenticator app used to organize and generate time-based one-time passwords and other security codes for multiple accounts in a central location.
The system distinguishes itself as an API-driven security manager, allowing authentication codes to be integrated into automated workflows and external applications. It also supports shared security credentialing through the use of isolated vaults and shared folders for team collaboration.
The project covers a broad range of security and data management capabilities, including symmetric secret encryption, hardware security integration, and detailed authentication event auditing. It provides utilities for account data migration, relational data persistence, and access attempt monitoring.
Installation options include automated cloud platform deployment and support for custom path hosting.
Features
- One-Time Passwords - Implements the TOTP algorithm to generate short-lived security codes based on shared secrets and system time.
- Two-Factor Authentication - Organizes and generates time-based one-time passwords and security codes for multiple accounts in a central location.
- Self-Hosted Deployments - Functions as a private, self-hosted server for storing encrypted authentication secrets with custom access controls.
- Data Protection - Secures authentication data using symmetric encryption and maintains access logs for sensitive secrets.
- Team Credential Vaults - Creates isolated vaults and shared access folders to collaborate on security codes within a team.
- User Identity Verification - Secures the interface using passwords, passkeys, tokens, or external identity providers.
- MFA Account Registration - Adds new authentication accounts using QR scanners, manual entry, or file imports to generate security codes.
- TOTP Vaults - Acts as a self-hosted vault for generating and managing time-based one-time passwords.
- Symmetric Secret Stores - Encrypts authentication secrets at rest using a master key to prevent data exposure from database leaks.
- Server-Side Encrypted Secret Stores - Encrypts authentication secrets at rest in the database to protect them from unauthorized access.
- Self-Hosted Vaults - Provides a private, user-managed installation for storing encrypted security secrets with shared vault support.
- Web-Based Authenticator Interfaces - Provides a browser-accessible interface for retrieving security codes through a web dashboard or extension.
- Authentication Integration APIs - Offers a programmable interface for integrating two-factor authentication data into external applications.
- Per-Client Request Throttlers - Prevents API abuse by limiting the number of requests allowed per minute from a single IP address.
- Authentication Workflow Automation - Enables programmatic management of authentication data to integrate security credentials into external workflows.
- Browser Extension Credential Retrievers - Ships a dedicated browser extension for capturing security secrets and generating one-time passwords.
- Brute Force Protections - Protects user accounts from brute-force attacks by blocking access after multiple failed login attempts.
- Session Security Integration - Integrates hardware security keys and enforces automatic logout timers to protect inactive sessions.
- Credential Sharing - Enables team collaboration through isolated vaults and shared folders for two-factor authentication codes.
- MFA Data Imports - Adds security accounts from external applications using QR codes or compatible data files.
- Personal Access Tokens - Provides personal access tokens to secure programmatic management of security accounts via HTTP headers.
- Request Throttling - Limits the frequency of login and API requests by tracking IP addresses to prevent brute-force attacks.
- Credential Data Migrations - Transfers existing account information from external JSON exports or QR codes into the current system.
- Secrets and Credential Management - Injects sensitive keys and passwords via secure files to prevent exposure in plain-text environment variables.
- Inactivity Session Termination - Implements automatic session termination based on periods of user inactivity.
- Token-Based Authentication - Validates personal access tokens in HTTP headers to allow programmatic management of authentication codes.
- MFA Account Onboarding - Allows automatic registration of two-factor authentication accounts through QR code scanning or file uploads.
- Security Account Management - Provides an API to programmatically interact with stored security accounts, groups, and settings.
- Personal Management - Web application for managing two-factor authentication accounts.
- Authentication and Security - Web application for managing two-factor authentication accounts.
- الأمن والخصوصية - Manager for two-factor authentication accounts and codes.
