Manage 2FA methods

Help
1

Hello dear VaultWarden community,

Just starting the password management with a fresh VW server.

I’d like to restrict the 2FA tools to only WebAuthn/Fido2 with hardware keys (typically Yubico security keys NFC) for the second factor.

So in this purpose, I wanted to make only this one only visible in the providers list, and I tried to disable the 3 other ones. Here is the result:

  • _ENABLE_EMAIL_2FA=false is OK, the email 2FA has disappeared :+1:
  • _ENABLE_DUO=FALSE and DUO_USE_IFRAME=false : fails, the Duo option is still listed in the 2FA providers list. That’s odd :thinking:
  • And I did not find any parameter to disable the OTP Application, so this option is still available and users can still use it instead of only hardware security keys. :disguised_face:

Here is the screenshot of the result :

OTP
OTP1132×592 52.3 KB

What would you please advise me to do to avoid/disable these two unwanted methods ??

(I am aware of the “necessity to have two security keys to avoid accidents when losing one key” principle/concept)

Many thanks !

2

You can hide authentication providers by customizing CSS:

I’ve updated the wiki page because we made this easier.

3

That’s great, I didn’t know it was possible to ‘tweak’ with the CSS now, I’ll look closely into this !
Many many thanks Stefan for such a quick answer !!