Two-factor authentication required for provenpackager members

Project Discussion
, ,
1

Hi everyone,

FESCo has voted to require two-factor authentication (2FA) for all members of the provenpackager group (SHOULD is now upgraded to MUST). Please enable 2FA if you haven’t yet. During the three-month grace period, existing provenpackager accounts without 2FA can continue to be used, but 2FA is required for any new provenpackager members. After the end of the grace period, remaining provenpackager accounts will be temporarily downgraded until 2FA is enabled.

2FA is also strongly recommended for non-provenpackager accounts.

Please see Making sure you're not a bot! for more information on setting up 2FA in the Fedora Accounts System. It is recommended to maintain a backup of your 2FA tokens and/or enroll multiple devices (e.g., a hardware security device and a mobile authenticator app).

Any new users applying to the provenpackager group must have 2FA set up in Fedora Accounts.

For provenpackager members who currently do not have 2FA configured, a three month grace period (until 2026-09-24) is provided to set up 2FA in Fedora Accounts. Affected users will be emailed directly. Members who have not enabled 2FA by 2026-09-24 will be removed from the provenpackager group. Those members can be reinstated once they configure 2FA by filing a ticket with Fedora Infrastructure — they do NOT need to re-apply to FESCo for provenpackager access.

All the best,
Maxwell (on behalf of FESCo)

(this was also cross-posted to the devel-announce list)

3 Likes
2

How the 2FA check is done? Manually or there’s a way to query FAS/Noggin about that?

I was wondering if we can add the check to the periodic Inactive Provenpackager SOP made by a script.

BTW the fedora-pgm tools need to be migrated to the new forge, if that’s not done already.

1 Like
3

Yubikey 5 setup

Complete this to get your Base32 string, discard the beginning example: otpauth://totp/Leigh_OTP?secret=

https://docs.fedoraproject.org/en-US/fedora-accounts/user/#twofactor

sudo dnf install -y yubikey-manager pcsc-lite pcsc-lite-ccid
sudo systemctl enable --now pcscd

This can be whatever you like “Fedora:leigh”

ykman oath accounts add "Fedora:leigh"

Enter the Base32 string

And complete setup on fedoraproject page, you will to enter the new OTP

ykman oath accounts code

bashrc edit to ease use

alias fedcode="ykman oath accounts code | grep 'Fedora' | awk '{print $2}'"

leigh@mpd-pc:~$ fedcode
599930
leigh@mpd-pc:~$ fkinit --user=leigh123linux
🔐 FAS password: •••••••••••••••         
🔐 FAS OTP (leave blank if not configured): ••••••                  

Ticket cache: KCM:1000
Default principal: leigh123linux@FEDORAPROJECT.ORG

Valid starting     Expires            Service principal
24/06/26 19:24:45  25/06/26 23:24:44  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
	renew until 01/07/26 19:24:44
 leigh@mpd-pc:~$
5 Likes
4

How the 2FA check is done? Manually or there’s a way to query FAS/Noggin about that?

Manually via an admin script.

I was wondering if we can add the check to the periodic Inactive Provenpackager SOP made by a script.

Not without making the script use an admin token I’m afraid.

BTW the fedora-pgm tools need to be migrated to the new forge, if that’s not done already.

Yep. Thats going to likely happen next week.

1 Like
5

That’s really helpful - thank you!

I also found you can use -s if there’s only one match, in which case it will only output the code (no need for awk):

$ ykman oath accounts code -s Fedora
Touch your YubiKey...
416009

(I added the account with --touch too, hence the “Touch your YubiKey...”)

1 Like