Multi-factor authentication (Duo)¶
Multi-factor authentication (MFA) is used across IGWN computing to confirm your identity with something more than a password: a physical device (a phone, a hardware token) that a stolen password alone can't reproduce. IGWN uses Duo for this.
Duo MFA is required in two contexts:
- SSH (command-line) access to LDG clusters — required today. See MFA for SSH access.
- LIGO.ORG web services signed in to through a browser — required starting September 1, 2026. See MFA for web logins.
One Duo account, one set of devices
Enrollment is per person, not per service. If you've already registered a device for SSH, that same device works for web logins too — there is nothing further to set up. You only need to register if you have never enrolled in Duo before.
Second factor methods: SSH vs. web¶
Not every second-factor method works in every context. In particular, Touch ID (macOS) and Windows Hello only work for web logins: SSH has no browser available to complete that platform-biometric (WebAuthn) check, so Duo's SSH integration doesn't offer them.
| Second factor | SSH | Web |
|---|---|---|
| Duo Mobile app (push or passcode) | Yes | Yes |
| Hardware token (YubiKey 5 NFC) | Yes | Yes |
| Touch ID (macOS) | No | Yes |
| Windows Hello | No | Yes |
Using both SSH and web?
If you'll use both, register Duo Mobile app or a hardware token first, so the same device works everywhere. You can always add Touch ID or Windows Hello afterwards as an additional method for the convenience of web-only sign-ins — see Managing your devices.
Enrolling for the first time¶
If you have never registered a Duo second factor, the simplest path is to check your status and register for web logins, since it doesn't require a terminal. If you'd rather enroll via SSH first, see MFA for SSH access — either path enrolls the same Duo account.
Duo Mobile app OS requirements
The Duo Mobile app requires Android 12+ or iOS 17+. If your phone is stuck on an older OS (for example, an Android 11 device that can no longer update), Duo Mobile may fail to install or update, and Duo no longer supports it — use a hardware token instead, or ask for help.
In this section¶
- MFA for SSH access — SSH portal and SSH proxy methods, enrollment, and testing your setup.
- MFA for web logins — checking your status, registering, and trying Duo early for web services.
- Hardware tokens — using a YubiKey 5 NFC instead of the Duo Mobile app.
- Managing your devices — adding, renaming, or removing a device yourself, without help desk support.