Computer Security: 2FA to the TechNet

CERN has completed the rollout of two-factor authentication (2FA) across its major remote access systems, including the Linux interactive service (LXPLUS) and the Windows Terminal Server (WTS) gateways. This change aims to enhance security for all interactive logins to the CERN Single Sign-On, Linux interactive service, and Windows Terminal Server gateways.

The eduVPN service has been added to further protect remote access to CERN's IT services and the CERN Campus network. While some minor improvements, such as refining 2FA usage for the LXPLUS fast-track service, are still needed, the majority of remote accesses have been updated. CERN requires all interactive logins to be 2FA-protected, with the LS3 project underway focusing on remote TN access from both the internet and the Campus network.

Previously, remote access to TN using centrally managed Linux servers or personal development VMs was unrestricted, relying only on password protection. Now, only 2FA-protected remote access gateways, such as LXTUNNEL, eduVPN, and WTS gateways, will be allowed for remote access. The IT Department has deployed TNPLUS, a new Linux cluster complementing the TN SWAN notebook service.

An alternative access path remains via 2FA-protected Remote Operations Gateways (ROGs). Other human-interactive access paths will be blocked. Non-centrally managed VMs will be restricted to the TN or converted to become ATS-managed instances, with any unjustified or unmaintained access rights being revoked. Minor adjustments may continue over the next year to remove remaining password-only backdoors and deviations from new standards. This marks the full implementation of CERN's general 2FA strategy.