Teleport: Recovery codes for 2FA

[sh7dm]

Feature Request

Ability to restore access if access to 2nd factor is lost.

Motivation

Github, Google and others have scratch codes for recovery, it'll be great to have those in Teleport.

Who's it for?

OSS User, Pro, Enterprise

[sh7dm]

Should this have some :+1:s or I may start working on this now?

[webvictim]

Please feel free to write PRs for whatever you like; we’ll review them!

[sh7dm]

Hmm, as I think now, it doesn't make a lot of sense now. 2FA cannot be fixed w/o administrator anyway. Probably we can implement these codes only for emergency access, where's no time to message the admin. I'll try to make them work. Full functionality will be there when #2280 and #2923 are done.

[sh7dm]

Work in progress!
Task list:

• [x] Create tokens
• [x] Accept tokens
• [ ] Show tokens
• [ ] Regenerate tokens
• [ ] Audit events
• [x] U2F support

[alex-kovoy]

@sh7dm we are adding a support for reset tokens in Teleport V5. This feature has been already implemented https://github.com/gravitational/teleport/pull/3287 in the hornet branch (our code name for TeleportV5).

[sh7dm]

Is it for resetting password only or pass+2FA?

[alex-kovoy]

pass+2FA+what you have listed in the task list as well. If curious, you may build the 'hornet' branch to take a look and perhaps give us some feedback.

and thanks a lot for willing to contribute to this project!

closing it as a dup of https://github.com/gravitational/teleport/issues/1294

This is to be released in V5.

[alex-kovoy]

If curious, you may build the 'hornet' branch to take a look and perhaps give us some feedback.

There are some temporary private dependencies which would prevent you from building the hornet branch so that would have to wait.