Secure Red Hat user accounts with two-factor authentication (2FA)

Red Hat allows users to enable two-factor authentication (2FA) as an additional layer of security for logging in to their Red Hat user accounts.

To ensure Red Hat account access is restricted to the intended user, you can add an extra layer of protection beyond just a password. When two-factor authentication is enabled, you use your password plus a one-time code to log in to your account. Utilizing these two authentication factors ensures that even if an unauthorized individual finds your password, they still can not access your account. For daily access, use an authenticator app on your smartphone to instantly generate a one-time code. Alternatively, generate a list of backup recovery codes to use in case you can not access the authenticator app on your smartphone.

Customers have two options for securing Red Hat user accounts with 2FA:

  • Organizational two-factor authentication. Require all users who belong to a specific organization account to use two factors each time they authenticate by enabling two-factor authentication for the organization. Users will be prompted to enable two-factor authentication upon the first log in attempt after the organization account is enrolled. Note
    The Organization Administrator for an account can enable organization-wide two-factor authentication. When enabled, all users on that account must use two-factor authentication for authentication when they log in.
  • Individual opt-in two-factor authentication. Offer individual users the option to enable or disable two-factor authentication for their Red Hat account. Note
    When organizational two-factor authentication is turned on, individual users cannot disable it.

Token support for 2FA one-time codes is limited to smartphones or other devices that can install either of the following applications from the Apple App Store or the Google Play Store:

  • Google Authenticator
  • FreeOTP Authenticator

Google Authenticator and FreeOTP Authenticator are the only supported token generators. Hardware tokens, SMS (text-message) tokens, and other apps are not supported.

Note
The current implementation of two-factor authentication only applies to applications using a browser-based authentication flow. It does not apply to command line authentication flows.

Require two-factor authentication (2FA) for all users in your organization
Copy link

To promote the security of Red Hat user accounts associated with your organization, the Organization Administrator can enable a two-factor authentication requirement for all users in the organization.

Before you begin
Copy link

  • Ensure you are using a registered Red Hat account with Organization Administrator permissions.
Note
Google Authenticator and FreeOTP Authenticator are the only supported token generators for providing two-factor authentication one-time codes. Hardware tokens, SMS (text-message) tokens, and other apps are not supported. You can install these apps on your smartphone or other compatible Android or iOS device.
 Note
When a user enables individual opt-in two-factor authentication for their user account through their Signing in settings, two-factor authentication remains enabled for their account regardless of organization-level requirements.

Procedure
Copy link

  1. Log in to Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission.
  2. From the home page after you log in, click ⚙ (Settings).
  3. Click Authentication Policy.
  4. When the Authentication Policy window appears, click Authentication Factors.
  5. On the Authentication factors page, check Enable two-factor authentication for your organization.
  6. Click Save.

Results
Copy link

Once organization-wide two-factor authentication is enabled, all users will be prompted to set up an authenticator app upon their next login. After this initial configuration, a one-time code from the app will be required for every subsequent login.

Set up two-factor authentication (2FA) for your individual Red Hat account
Copy link

To secure your individual Red Hat user account when organization-wide two-factor authentication is not required, you will need to enable 2FA and set up an authenticator app on your smartphone or other device.

Before you begin
Copy link

  • Ensure you are using a registered Red Hat user account.
  • Ensure you have a smartphone or other device with the Google Authenticator app or the FreeOTP app installed.
Note
Google Authenticator and FreeOTP Authenticator are the only supported token generators for providing two-factor authentication one-time codes. Hardware tokens, SMS (text-message) tokens, and other apps are not supported. You can install these apps on your smartphone or other compatible Android or iOS device.
 Note
If your company policy requires two-factor authentication to access your Red Hat account and you have not yet enabled two-factor authentication, you will see the instructions to enable two-factor authentication immediately after you log in.

Procedure
Copy link

  1. Log in to your Red Hat user account on any Red Hat site, such as Red Hat Customer Portal.
  2. Click your user avatar in the upper right corner of the panel.
    1. Click Account details. A page opens where you can edit your account information.
    2. If you log in through Red Hat Hybrid Cloud Console, click My profile under your user avatar to edit your account information.

      A page opens where you can review your account information.

      Note
      Depending on which login portal you use, a different icon may appear.
  3. Click Login & password.
  4. On the Login & password page click Manage two-factor authentication. The Signing in page opens.
  5. On the Signing in page, click Set up authenticator application. You must log in again to verify your account before the Enable two-factor authentication page opens.
  6. Open the authenticator app on your smart phone and select the option to add a token. You can use one of these methods to add a token for the Red Hat two-factor authentication.
    1. Use the authenticator app to scan the QR code that opens on the two-factor authentication page.
    2. Alternatively, you can click Unable to scan? Enter the key instead which displays a 32-character key string that you must enter into your authenticator app.
  7. After you scan the QR code (or enter the key string), the authenticator app creates an initial one-time 6-digit code. Enter this code into the One-time code field.
  8. You can enter an optional name in the Device name field. This name can remind you which of your mobile devices has the authenticator app for this login.
  9. Click Enable to complete setting up two-factor authentication.
    Note

    While you update your signing in options, you might be asked to log in again. This is a normal action and is provided to increase account security.

Results
Copy link

The Signing In page opens when the authenticator app was set up and any optional name you gave to the app.

img RH 2FA enable complete

Remove your two-factor authentication (2FA) requirement
Copy link

You can remove the two-factor authentication for your Red Hat user account.

Before you begin
Copy link

  • Ensure you have a registered Red Hat user account with two-factor authentication enabled..
  • Ensure you have a smartphone or other device with the Google Authenticator app or the FreeOTP app installed.
Note
You will be required to reenable two-factor authentication at your next login attempt if your Organization Administrator requires two-factor authentication for all users in the organization.
 Note
A new token is added to your authenticator app each time you disable and re-enable 2FA for your Red Hat account. It is your responsibility to manage disabled tokens on your device.

Procedure
Copy link

  1. Log in to your Red Hat user account using two-factor authentication.

    For instructions on signing in to your Red Hat user account using two-factor authentication, see Sign in to your account with your 2FA authenticator application

    If you have lost your authenticator device and need Red Hat Support to revoke your two-factor authentication, see Recover account access.

  2. Click your user avatar in the upper right corner of the page.
    1. Click Account details. A page opens where you can edit your account information.
    2. If you log in through Red Hat Hybrid Cloud Console, click My profile under your user avatar to edit your account information.

      A page opens where you can review your account information.

      Note
      Depending on which login portal you use, a different icon may appear.
  3. Click Login & password.
  4. On the Login & password page click Manage 2-factor authentication. The Signing in page opens.
  5. Click Delete to remove two-factor authentication for your user login.
    Note
    The Delete button disables, or turns off two-factor authentication for your user login. If you reenable two-factor authentication, you will repeat the enable authentication steps, which adds a new token to your authenticator app. The token associated with the disabled authenticator will no longer work.
  6. For verification you must log in again with two-factor authentication. A page appears where you click CONFIRM DELETION to remove two-factor authentication from your user account. After you confirm deletion, you return to the Signing in page.

Manage alternative authentication options
Copy link

A recovery code can be used as an alternative authentication factor if your authenticator app is not available.

Important
If you choose not to set up recovery codes, you might lose access to your account.

When updating your signing in options, you might be asked to log in again. This is a normal added security measure. If you cannot successfully log in to your Red Hat account with recovery codes enabled, contact Red Hat Support for assistance in resetting your account.

When you set up recovery codes, you get a list of codes that are unique to your login. Each code can be used once, and the system tracks each code as it is used. You can also remove the recovery codes for your user account.

Create recovery codes for two-factor authentication (2FA)
Copy link

You can use a recovery code to authenticate and log in to your account if you lose your authenticator device or your authenticator app is not available. Create recovery codes after you enable two-factor authentication for your account.

Before you begin
Copy link

Procedure
Copy link

  1. Log in to your Red Hat user account on any Red Hat site, such as Red Hat Customer Portal.
  2. Click your user avatar in the upper right corner of the page.
    1. Click Account details. A page opens where you can edit your account information.
    2. If you log in through Red Hat Hybrid Cloud Console, click My profile under your user avatar to edit your account information.

      A page opens where you can review your account information.

      Note
      Depending on which login portal you use, a different icon may appear.
  3. Click Account details. A page opens where you can edit your account information.
  4. Click Login & password.
  5. On the Login & password page scroll down to 2-factor authentication and click Manage 2-factor authentication. The Signing in page opens.
  6. Click Set up recovery codes.
  7. The Recovery codes page opens and shows a list of unique codes.
  8. Carefully follow the instructions on this page to print, download, or copy the list of codes.
    Important
    Keep the recovery codes in a safe place. When you enable recovery codes, the next time you log in you will be asked for a recovery code.
  9. Click Complete setup to return to the Signing in page.
  10. The Signing in page verifies when you created the recovery codes and how many have been used.

    img recovery code enabled

Remove recovery codes for two-factor authentication (2FA)
Copy link

You can remove existing recovery codes from your Red Hat account. If you remove recovery codes for codes completely, you do not recieve the option to "Use a recovery code instead" when attempting to log in to your Red Hat account.

Before you begin
Copy link

Procedure
Copy link

  1. Log in to your Red Hat user account on any Red Hat site, such as Red Hat Customer Portal.
  2. Click your user avatar in the upper right corner of the panel.
    1. Click Account details. A page opens where you can edit your account information.
    2. If you log in through Red Hat Hybrid Cloud Console, click My profile under your user avatar to edit your account information.
  3. Click Account details. A page opens where you can edit your account information.
  4. Click Login & password.
  5. On the Login & password page scroll down to 2-factor authentication and click Manage 2-factor authentication. The Signing in page opens.
  6. Scroll down to Recovery codes.
  7. Click Remove.

    img recovery code enabled

    After you remove recovery codes, you can create a new set.

Access your account securely
Copy link

When two-factor authentication is enabled and configured, you can use an authenticator application or a recovery code to securely log in to your Red Hat account. This process provides a second layer of authentication to ensure that only authorized users can access the account.

Sign in to your account with your 2FA authenticator application
Copy link

Use a one-time code provided by your authenticator app to log in to your Red Hat user account on any Red Hat site, such as Red Hat Customer Portal.

Before you begin
Copy link

Procedure
Copy link

  1. Open the authenticator app.
  2. Use your browser to navigate to a Red Hat site, such as Red Hat Customer Portal.
  3. Enter your Red Hat login.
  4. Enter your Red Hat password. A page opens to verify two-factor authentication.
  5. Enter the 6-digit one-time code from your authenticator app into the One-time code box and click Log in.
    Note
    The authenticator app refreshes the one-time code every 30 seconds. Because of the timing, you might need to enter a refreshed code if the initial code does not work.

If the 6-digit one-time code is not accepted, you will remain on the verification page. You can try the following actions:

  1. Wait a few seconds and enter a new code from your authenticator app.
  2. If you have more than one token enabled in your authenticator app, make sure you are using the token for your Red Hat account. For example, you might have two-factor authentication tokens for a Google account, a banking account, and a Red Hat account.
  3. If you cannot successfully log in to your Red Hat with two-factor authentication enabled, contact Red Hat Support for assistance in resetting your account.

Sign in to your account with your 2FA recovery codes
Copy link

Use a recovery code to log in to your Red Hat account if your authentication device is not available.

Before you begin
Copy link

Procedure
Copy link

  1. Use your browser to navigate to a Red Hat site, such as Red Hat Customer Portal.
  2. Log in using your Red Hat login.
  3. Enter your Red Hat password. A page opens to verify two-factor authentication and asks for a one-time code.
  4. Click Try another way.

    You are prompted to choose recovery codes.

  5. Enter the recovery code from your list and click Log in.

Verify your information for account recovery
Copy link

Red Hat requires a verified email and phone number to ensure you have reliable recovery options for your account.

To proceed with two-factor authentication, ensure your account has a verified email and phone number. This information is required in order for Red Hat Customer Service to assist you with the account recovery process should you lose access.

Verify your email information
Copy link

You may receive an email verification request while logging in to a Red Hat portal. Follow the steps to verify your email address when this request appears:

Before you begin
Copy link

  • Ensure you have a registered Red Hat user account.
  • Ensure you have an email address where you can receive a verification notice.
  • Confirm that you receive an email verification request notice when you log in to a Red Hat platform.

Procedure
Copy link

  1. Log in to your Red Hat user account.
  2. When a verification alert message appears, click Resend verification email if you have not yet received a verification email.
  3. Check your email for an email verification message from no-reply@redhat.com.
  4. Follow the instructions in the email for verifying your email address.
  5. When you complete the instructions, a verification window appears.

Verify your phone information
Copy link

You may receive a phone number verification request while logging in to a Red Hat portal. Follow the steps to verify your phone number when this request appears:

Before you begin
Copy link

  • Ensure you have a registered Red Hat user account.
  • Ensure you have a phone number where you can receive direct voice calls.
  • Confirm that you receive a phone number verification request when you log in to a Red Hat platform.

About this task
Copy link

Note
The phone number is required and must be able to receive phone calls directly to you if you need to recover your account.

Procedure
Copy link

  1. Log in to your Red Hat user account, and navigate to the Account details page.
  2. Enter your contact phone number, including any country code, in the verification window.
  3. Click Submit.

Recover account access
Copy link

You can revoke the two-factor authentication requirement on your Red Hat account if both your authenticator application and recovery codes are unavailable and you have no other way to log in to your account.

Red Hat Customer Service can quickly revoke two-factor authentication with a phone call or seven-day email response after you create a support ticket.

Revoke two-factor authentication (2FA) via phone
Copy link

To quickly revoke two-factor authentication on your account, you must be reachable by phone. If you can not accept a return call from Red Hat Customer Service, the two-factor authentication on your account can not be quickly revoked.

Before you begin
Copy link

  • Ensure you are reachable at the phone number registered to your account.
  • See Verify your phone information for information about setting up your contact information.

Account verification through a phone call from Red Hat Customer Service to your account phone number is the only method approved by the Red Hat security teams for quickly allowing two-factor authentication settings to be revoked. There are no exceptions to this process.

Procedure
Copy link

  1. Contact Red Hat Customer Service to open a support ticket to revoke your two-factor authentication.
  2. After a support ticket is opened and assigned, Red Hat Customer Service places a call to the phone number of record for your account. This two-step process with outgoing call confirmation protects the security of your account. It is the only method approved by the Red Hat security team that allows two-factor authentication settings to be revoked by phone.
  3. After two-factor authentication is revoked, you can log in using your valid password. Depending on your organization policy, you might be required to reenable two-factor authentication after you log in.

Revoke two-factor authentication (2FA) via email
Copy link

When you cannot accept a call to the phone number of record for your account, the Red Hat Customer Service team sends an email notification to the email address associated with your account.

Before you begin
Copy link

  • Without a phone contact, Red Hat support sends an email to the address registered to your account.
  • See Verify your email information for information about setting up your contact information.

Procedure
Copy link

  1. Contact Red Hat Customer Service to open a support ticket to revoke your two-factor authentication.
  2. After a support ticket is opened and assigned, Red Hat Customer Service will attempt to contact you by phone at the number registered to your account.
  3. When you can’t be reached by phone, Red Hat Customer Service sends an email to the address registered to your account.
  4. The account holder is notified that two-factor authentication will be revoked in 7 days. You can reply to the notification email if you decide you do not want two-factor authentication revoked.
  5. After two-factor authentication is revoked, you can log in using your valid password. Depending on your organization policy, you might be required to reenable two-factor authentication after you log in.