Computer Security: 2FA to the TechNet
CERN has completed a two-factor authentication roll-out for major remote access services, including Single Sign-On, LXPLUS, WTS, and eduVPN, enhancing security for its IT infrastructure and accelerator controls.
CERN has finalized the two-factor authentication (2FA) roll-out for its Single Sign-On, Linux interactive service (LXPLUS), Windows Terminal Server (WTS), and eduVPN services, ensuring all major remote accesses to CERN’s IT services and campus network are protected by advanced security measures. While minor improvements remain, such as refining 2FA usage for the LXPLUS fast-track service LXTUNNEL, the majority of remote access points have been updated to meet current security standards.
The Technical Network (TN) for accelerator and infrastructure controls now requires 2FA for all interactive logins, aligning with the ongoing LS3 upgrade. Previously, remote access to the TN via centrally managed Linux servers or personal VMs relied solely on password protection, but this has now been upgraded to 2FA. Remote WTS access was already 2FA-protected as part of the general roll-out, and similar protections have been extended to other TN remote access methods.
To enforce these changes, the ATS system administration team will restrict remote access to TN Linux servers or VMs to 2FA-protected gateways, including LXTUNNEL, eduVPN, or WTS gateways. The IT Department has also deployed TNPLUS, a new Linux cluster dedicated to the TN, complementing the existing TN SWAN notebook service. Alternative access remains available via 2FA-protected Remote Operations Gateways (ROGs), while all other human-interactive access paths will be blocked.
Over the next year, CERN will review and restrict access for non-centrally managed VMs and accounts, removing unjustified or inactive access rights. Minor adjustments will continue to eliminate remaining password-only backdoors and non-standard accesses. The IT Department emphasizes that the general 2FA strategy has now been fully implemented, with gratitude extended to all contributors for enhancing digital security across CERN’s accelerator complex.