[Plugin] Aegis MFA - two-factor authentication for the Unraid webGUI

Aegis MFA adds a second step to the webGUI login. After the password you enter a 6-digit code from an authenticator app (Google Authenticator, Authy, 1Password, any TOTP app), or you confirm with a passkey: fingerprint, face, PIN or a hardware key. Nothing leaves your server. No account, no cloud, no phone-home.

What you get:

- Ten single-use backup codes. Enrolment does not finish until you type one back, so you cannot skip them and lock yourself out later.

- Trusted LAN: networks that skip the code prompt and still need the password.

- Lockout after five failed codes per IP, with a history and an unlock button.

- Dry run: turn it on, watch the syslog for a day, enforce when you are comfortable.

- A grace period for accounts that have not set up yet.

- Fail-open: if an Unraid update changes the login files, the plugin steps aside instead of locking you out.

If you do get locked out there is always a way back in: a backup code, "aegis-mfa disable" over SSH, a recovery script on the flash, or an empty DISABLE.flag file on the boot stick (USB boot only). All of it is in the README.

Requirements: Unraid 7.3.1 or newer. Passkeys need HTTPS with a hostname; the myunraid.net certificate from Settings > Management Access is enough, no domain of your own.

Install from Community Applications, search for Aegis MFA.

Source, README and changelog: https://github.com/Lazaros-Chalkidis/unraid-aegis-mfa

Support is on GitHub only. Bug reports, questions and requests go to GitHub Issues, not this thread. I do not follow forum threads for support, and a problem buried on page 14 of a thread helps nobody. One issue per problem, with the plugin version and your Unraid version, and I will answer there.

Two notes:

1. If you remember my earlier threads for this and the other plugins: I set them to hidden while I was fixing a few things, and a bug in the forum software made them disappear for good instead of hiding them. I could not get them back, so I am reposting one at a time, starting with this one.

2. All my plugins are written with the help of AI. The design, the decisions, the testing on my own server and the responsibility for what ships are mine. I say it up front so nobody finds out later and feels misled.

Edited Saturday at 03:35 PM5 days by Lazaros Chalkidis
Upload Screenshot