How to add more than one user in excluded_account registry settings of multiOTP cred provider

[ashishsabu]

Hello Team,

I need help in below two points-

1. how to add more than one user in excluded_account registry setting ?
2. How to exclude more than one user from multiotp authentication?
3. how to add users in multiOTPWithout2FA ?

Thanks and Regards, Ashish Sabu

[multiOTP]

Hello,

• The excluded_account feature is for recovery process, and only one account is authorized.
• In order to have "real" users excluded from the authentication process, you have to create users with a "without2fa" token (instead of a totp/hotp/motp) Keep us in touch, and regards

[multiOTP]

Hello, Could you please exactly explain what you are doing, and what is your current configuration ? Are you trying to connect using RDP somewhere ? Please send us the complete registry settings, and explain also your setup (only one computer with multiOTP Credential Provider and you try to log on locally, one computer without multiOTP Credential Provider and a remote computer with multiOTP Credential Provider on which you try to connect using RDP, etc.) Describe us the process step by step of what you are doing Provide us also printscreen of the various page displayed, indicating in which step of your process you are. Thx and regards

[ashishsabu]

Hello Team,

I have install multiOTP Credential Provider on single setup and update the value of below parameters in multiOTP.ini file. max_block_failures=4 max_delayed_failures=4

that means user account will get locked after 4 incorrect TOTP login attempts. this scenario is working fine if I entered 4 different TOTP at each login attempt. but if I enter same TOTP at each login attempt then user account will not get locked.

for example- If I have enter same TOTP - 123456 at each login attempt. even after 10 unsuccessful login attempts user account is not locked. I have found the below line in multiOTP.log

• Error: authentication failed (using Credential Provider) for user "username"(same token replayed)

Could you please help.

Thanks and Regards, Ashish Sabu

[multiOTP]

Hello Ashish, Replaying the same token again and again will not lock the account, but it will only count once. This is because depending the client implementation doing the radius authentication, if a successful connection is lost, it tries several times to send the previous successful authentication, which is not considered as an attack, but a bad replay attempt which is refused and traced. Please not also that we will clsoe the cas here, as it's not related to the initial topic. Regards,