Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is a security method that requires two independent pieces of evidence to verify a user's identity before granting access. It adds a second factor on top of the traditional username and password, so that a stolen or guessed password alone is not enough to log in. 2FA is a specific case of multi-factor authentication (MFA), which requires two or more factors.

What is two-factor authentication?

Authentication factors fall into three categories, and 2FA combines factors from two different categories so that compromising one does not compromise the whole:

• Something you know, a password, PIN, or passphrase.
• Something you have, a phone running an authenticator app, a hardware security key, or a smart card.
• Something you are, a biometric such as a fingerprint or facial scan.

Requiring two factors from the same category (for example, two passwords) does not qualify as 2FA, because a single type of compromise could defeat both. The strength of 2FA comes from the factors being independent.

Why 2FA matters

Passwords are the weakest link in most systems. They are reused across sites, phished, leaked in breaches, and guessed through brute force. 2FA neutralizes these attacks: even if an attacker obtains a valid password, they still cannot authenticate without the second factor. This is especially important for remote access and cloud services, where accounts are exposed outside a protected corporate network.

Many compliance frameworks, including PCI-DSS, HIPAA, and CMMC, now require MFA for access to sensitive systems, making 2FA a baseline control rather than an optional enhancement.

How 2FA works

After a user submits a correct password, the system prompts for the second factor before granting access. Common second-factor mechanisms include:

• Authenticator apps that generate time-based one-time passwords (TOTP) that rotate every 30 seconds.
• Hardware security keys using standards such as FIDO2/WebAuthn, which resist phishing by binding the login to the legitimate site.
• Push notifications to a trusted device that the user approves or denies.
• SMS or email codes, which are convenient but weaker, as they can be intercepted or redirected via SIM-swapping.

Only after both factors are validated is the session established. On Linux, 2FA is commonly enforced through Pluggable Authentication Modules (PAM), which can require a one-time code or hardware token during login and SSH access.

2FA in HPC and enterprise Linux

Shared clusters and enterprise Linux fleets concentrate valuable data and compute, making credential theft a high-value target. Requiring 2FA for SSH and administrative access closes the most common attack path. It works best as one layer among several: role-based access control limits what an authenticated user can do, and encryption key management protects data even if a system is breached. Hardened builds of Rocky Linux integrate 2FA into login flows to meet these security baselines.