GDPR-compliant two-factor authentication for association websites with Virtualmin and TOTP

Why is two-factor authentication important for association websites?

Association websites often manage sensitive data such as member lists, bank details, and personal information. A breach can not only destroy members' trust but also lead to high fines under GDPR. Two-factor authentication (2FA) is an effective protection that prevents access even if passwords are stolen.

With TOTP (Time-based One-Time Passwords), you receive time-limited one-time passwords generated on your smartphone. This method is not only secure but also GDPR-compliant, as no additional personal data is stored.

Requirements for the setup

Before you start, make sure you have the following:

• A server with Virtualmin (e.g., from dezhost Virtual Servers)
• Access to the command line (SSH)
• A smartphone with a TOTP app (e.g., Google Authenticator, Authy)
• SSL certificate for your domain (available from dezhost Domains)

Step-by-step implementation guide

1. Virtualmin update and security packages

Make sure your Virtualmin is up to date:

sudo apt update && sudo apt upgrade -y

Install required packages for TOTP:

sudo apt install libpam-google-authenticator

2. Enable TOTP for the administrator

Log in via SSH and run:

google-authenticator

Answer the questions with 'y' and scan the QR code with your TOTP app. Note the emergency codes in a safe place.

3. Adjust PAM configuration

Edit the file /etc/pam.d/sshd and add the following line:

auth required pam_google_authenticator.so

Make sure the option ChallengeResponseAuthentication yes is set in the sshd_config.

4. Configure Virtualmin for 2FA

Virtualmin has no native 2FA support, but you can integrate it via the system. Go to Virtualmin > System Settings > Authentication and select 'PAM' as the authentication method. Save the changes.

5. Test and troubleshoot

Restart the SSH service and test the login. If you cannot log in, use the emergency codes or access the console of your hosting provider.

Ensure GDPR compliance

GDPR requires you to take appropriate technical measures to protect personal data. 2FA is such a measure. Additionally, you should:

• Anonymize logging data (shorten IP addresses)
• Regularly review access rights
• Provide a privacy policy that describes the use of 2FA

Since TOTP does not store personal data, the method is GDPR-compliant.

Further security measures for your association website

In addition to 2FA, you should also take other security precautions:

• SSL/TLS certificates for encrypted communication
• Regular backups (e.g., with Virtualmin backup function)
• Firewall configuration (e.g., UFW)
• Updating CMS and plugins

If you are looking for a reliable hosting partner, check out our web hosting packages that offer Virtualmin and high security standards.

Conclusion

With this guide, you can secure your association website with GDPR-compliant 2FA. The setup is simple and significantly increases security. Do not hesitate to implement other security measures to best protect your data.