Two-factor authentication for the console

Two-factor authentication (2FA) adds a one-time code from an authenticator app to your console sign-in, so a stolen password alone is not enough to get in. It is opt-in per operator — turning it on affects only your login.

Turning it on

1. Go to My Security.
2. Click Set up two-factor.
3. In your authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy, …) add a new account and enter the setup key shown, or use the otpauth:// link.
4. Enter the 6-digit code the app shows and click Confirm & enable.
5. Save your recovery codes. Ten one-time codes are shown once — store them somewhere safe (a password manager). Each lets you sign in if you lose your authenticator, and works only once.

From then on, signing in asks for your password and then a code.

Signing in with 2FA

1. Enter your username and password as usual.
2. On the next screen, enter the current 6-digit code from your authenticator — or a recovery code.

If a code is rejected, check your phone's clock is accurate (codes are time-based) and try the next one.

Turning it off

On My Security, enter a current code (or a recovery code) and click Turn off 2FA.

Lost your authenticator?

Two ways back in:

1. A recovery code — enter one instead of a code at the 2FA prompt.
2. From the server — an administrator with access to the box can clear your 2FA:

C:\portwall\control-plane\portwall-admin.exe disable-2fa --user <your-username>

This assumes PortWall is installed in the default folder, C:\portwall; if not, replace C:\portwall with its folder. After that you sign in with just your password and can set 2FA up again.

Notes

• 2FA protects the console login. API keys are a separate mechanism for scripts.
• There is intentionally no "require 2FA for everyone" switch — that is a common way to lock a whole team out. Enrol each operator individually.