sudo with MFA

sudo with MFA lets you run sudo commands in Websh terminal sessions without permanent sudo privilege. When you enter a sudo command, MFA verification is required before the command executes.

Requirements

  • Alpamon 1.3.2 or later installed on the target server
  • sudo with MFA enabled in workspace server access policies (this automatically installs the required PAM module on servers)

Enable sudo with MFA

  1. Go to Workspace settings > Security > Server access policies
  2. Enable Use sudo with MFA
  3. The PAM module is automatically installed on servers running Alpamon 1.3.2+

Note: Enabling sudo with MFA requires superuser privileges. Staff users can use sudo with MFA after it is enabled but cannot change this setting.

Note: sudo with MFA works independently from the Allow direct root access setting. Even when direct root access is disabled, users can still run sudo commands through sudo with MFA.

How it works

When you run a sudo command in the terminal:

  1. Enter a sudo command (for example, sudo systemctl restart nginx).
  2. An MFA verification required overlay appears in the terminal. Click Click to verify to open the verification window.
  3. After you complete MFA, the command executes.
  4. Subsequent sudo commands don’t require MFA again until the sudo with MFA timeout expires. This duration is set by workspace administrators in Server access policies.

If verification fails or the MFA session expires, the terminal asks you to re-run the command to authenticate again.

Sudo policies and grants

How a sudo command is authorized depends on your workspace’s Sudo access settings:

  • Sudo policies — administrators can pre-authorize specific commands for certain users or servers. A policy bound to a work session can allow MFA bypass, so a non-interactive caller (for example, an AI agent running exec) can run those exact commands without an interactive MFA prompt.
  • Approval — a sudo request can be authorized by an administrator’s approval.

Every authorization—by direct permission, policy, or approval—is recorded. Review it in Sudo history.

Last updated: