René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Hardening] F-03: Recommended Mandatory 2FA Enforcement from the Start.","articleBody":"### The required feature described as a wish\n\n\u003cimg width=\"894\" height=\"441\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/2e377d7c-2a4d-4e4f-bfbd-a5920411a44f\" /\u003e\n\n**Description:** The \"Tyranny of Default\" principle recommends enabling the global setting `mandate.user.2fa` from the start. Security can always be downgraded later, but most users will simply accept whatever defaults they are given. If `mandate.user.2fa` is not set, 2FA remains ineffective even for those users who have already enrolled.\n\n**Affected Components:** Management UI\n\n**Impact:** Without mandatory enforcement, users may choose not to enroll in 2FA. In environments with regulatory or compliance requirements (e.g., PCI-DSS, SOC 2), the absence of enforced MFA may constitute a compliance gap.\n\n**Steps to Reproduce:**\n- Log in to the CloudStack Management UI as a Root Admin.\n- Navigate to Configuration \u003e Global Settings.\n- Search for `mandate.user.2fa` and confirm the value is False.\n- Create a new user account at any permission level.\n- Log in as that user and confirm that access is granted without any 2FA prompt.\n\n**Recommended Remediation:** Set `mandate.user.2fa` to True by default. Users will be naturally guided to set up 2FA at first login without friction, and the first impression of the ACS project will reflect a stronger security posture.","author":{"url":"https://github.com/davift","@type":"Person","name":"davift"},"datePublished":"2026-06-04T00:53:20.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/13335/cloudstack/issues/13335"}