As of April 2026, TOTP is not supported as a second authentication factor when connecting via SSH to Amazon FSx for NetApp ONTAP
This page has been translated by machine translation. View original
I want to use MFA when connecting via SSH to an FSxN file system or SVM
Hello, this is Non-pi (@non____97).
While operating Amazon FSx for NetApp ONTAP (hereafter FSxN), have you ever wanted to use MFA when connecting via SSH to an FSxN file system or SVM? I have.
NetApp ONTAP supports MFA when using SSH with local accounts on the cluster or SVM, as shown below. The supported MFA methods differ depending on the ONTAP version. The currently supported combinations are as follows.
| Release added | First authentication method | Second authentication method |
|---|---|---|
| ONTAP 9.14.1 | SSH public key | TOTP |
| User password | TOTP | |
| SSH public key | Cisco Duo | |
| User password | Cisco Duo | |
| ONTAP 9.13.1 | SSH public key | TOTP |
| User password | TOTP | |
| ONTAP 9.3 | SSH public key | User password |
Excerpt : Learn about ONTAP multifactor authentication
Isn't TOTP the most common second authentication factor in MFA?
However, even after searching the official AWS documentation, I could not find any mention of TOTP support in FSxN.
Let's actually try it.
Summary up front
- As of April 2026, TOTP is not supported as a second authentication factor for SSH connections to Amazon FSx for NetApp ONTAP
- As an alternative, if you want to improve the security of fsxadmin, use a combination of password authentication and public key authentication
Trying it out
Combination of password authentication as primary authentication / TOTP as secondary authentication for the fsxadmin user
Let's actually configure it.
As a test, we'll set up MFA for fsxadmin, the most powerful privilege available to operators on an FSxN file system.
The version is ONTAP 9.17.1, which supports TOTP.
::> version
NetApp Release 9.17.1P6: Wed Mar 25 15:38:10 UTC 2026
The current authentication methods of fsxadmin are as follows.
::> security login show -vserver FsxId055301943970047df -user-or-group-name fsxadmin
Vserver: FsxId055301943970047df
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
fsxadmin http password fsxadmin no none
fsxadmin ontapi password fsxadmin no none
fsxadmin ssh password fsxadmin no none
fsxadmin ssh publickey fsxadmin - none
4 entries were displayed.
Following the official NetApp documentation below, we'll set TOTP as the secondary authentication, with primary authentication being password authentication.
::> security login modify -vserver FsxId055301943970047df -user-or-group-name fsxadmin -application ssh -authentication-method password -second-authentication-method totp
Error: command failed: For a given user and application, if the "-second-authentication-method" parameter is specified,
only one such login method is supported.
Yes, it resulted in an error. It means that for a combination of an application such as SSH or REST API and a supported login method, only one secondary authentication can be configured.
This time, two types of primary authentication, password authentication and public key authentication, are registered for SSH, so it was rejected.
We won't use public key authentication, so let's delete it and try again.
::> security login delete -vserver FsxId055301943970047df -user-or-group-name fsxadmin -application ssh -authentication-method publickey
::> security login show -vserver FsxId055301943970047df -user-or-group-name fsxadmin
Vserver: FsxId055301943970047df
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
fsxadmin http password fsxadmin no none
fsxadmin ontapi password fsxadmin no none
fsxadmin ssh password fsxadmin no none
3 entries were displayed.
::> security login modify -vserver FsxId055301943970047df -user-or-group-name fsxadmin -application ssh -authentication-method password -second-authentication-method totp
Warning: TOTP is initially disabled for user "fsxadmin". To enable TOTP, user "fsxadmin" must login and configure TOTP using the "security login totp create".
::> security login show -vserver FsxId055301943970047df -user-or-group-name fsxadmin
Vserver: FsxId055301943970047df
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
fsxadmin http password fsxadmin no none
fsxadmin ontapi password fsxadmin no none
fsxadmin ssh password fsxadmin no totp
3 entries were displayed.
We were able to register TOTP as the secondary authentication successfully.
At this point we have only specified the authentication method, and TOTP is not actually being used yet. Following the message shown when running security login modify and the official NetApp documentation below, we'll configure TOTP.
::> security login ?
banner> Manage the login banner
create Add a login method
delete Delete a login method
domain-tunnel> The domain-tunnel directory
duo> Manage Duo Configurations
expire-password Expire user's password
external-role-mapping> Manage the role mapping configurations for the external roles
group> Manage group configurations
lock Lock a user account with password authentication method
modify Modify a login method
motd> Manage the message of the day (MOTD)
password Modify a password for a user
publickey> Manage public keys
rest-role> Manage REST access control roles
role> Manage access control roles
show Show user login methods
totp> Manage totp
unlock Unlock a user account with password authentication method
whoami Show the current user, trust score of the user and role of this session
::> security login totp show
This table is currently empty.
::> security login totp create -username fsxadmin
Error: command failed: not authorized for that command
::> security login totp create?
create Add a TOTP secret
::> security login totp create ?
[ -vserver <vserver name> ] Vserver (default: FsxId055301943970047df)
[[-username] <text>] Username (default: fsxadmin)
[[-comment] <text>] Comment
Yes, it resulted in an error. The security login totp create command itself is recognized, but it won't accept the input.
Raising the privilege level to diag did not change the result.
::> set diag
Warning: These diagnostic commands are for use by NetApp personnel only.
Do you want to continue? {y|n}: y
::*> security login totp create -username fsxadmin
Error: command failed: not authorized for that command
Combination of password authentication as primary authentication / TOTP as secondary authentication for a new user with the fsxadmin role
Perhaps the problem is that fsxadmin is a default user?
As a workaround, we'll create a new user and configure it in the same way, with password authentication as primary authentication and TOTP as secondary authentication.
::*> security login create -vserver FsxId055301943970047df -user-or-group-name fsxadmin-non-97 -application ssh -authentication-method password -second-authentication-method totp -role fsxadmin -comment "for non-97 fsxadmin"
Please enter a password for user 'fsxadmin-non-97':
Please enter it again:
Warning: TOTP is initially disabled for user "fsxadmin-non-97". To enable TOTP, user "fsxadmin-non-97" must login and configure TOTP using the "security login totp create".
::*> security login show -vserver FsxId055301943970047df
Vserver: FsxId055301943970047df
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
autosupport console password autosupport no none
fsxadmin http password fsxadmin no none
fsxadmin ontapi password fsxadmin no none
fsxadmin ssh password fsxadmin no totp
fsxadmin-non-97
ssh password fsxadmin no totp
5 entries were displayed.
::*> security login totp create -username fsxadmin-non-97
Error: command failed: not authorized for that command
Yes, the result didn't change. It won't accept security login totp create.
As a test, we'll SSH in as this user and then configure TOTP.
> ssh fsxadmin-non-97@management.fs-055301943970047df.fsx.us-east-1.amazonaws.com
(fsxadmin-non-97@management.fs-055301943970047df.fsx.us-east-1.amazonaws.com) Password:
This is your first recorded login.
::> set diag
Warning: These diagnostic commands are for use by NetApp personnel only.
Do you want to continue? {y|n}: y
::*> security login totp create -username fsxadmin-non-97
Error: command failed: not authorized for that command
The result is the same.
Combination of password authentication as primary authentication / TOTP as secondary authentication for a new user with the vsadmin role
Then, is the fsxadmin role the problem?
We'll create a new user assigned the vsadmin role and configure it in the same way, with password authentication as primary authentication and TOTP as secondary authentication.
::*> security login create -vserver svm -user-or-group-name vsadmin-non-97 -application ssh -authentication-method password -second-authentication-method totp -role vsadmin -comment "for non-97 vsadmin"
Please enter a password for user 'vsadmin-non-97':
Please enter it again:
Warning: TOTP is initially disabled for user "vsadmin-non-97". To enable TOTP, user "vsadmin-non-97" must login and configure TOTP using the "security login totp create".
::*> security login show -vserver svm
Vserver: svm
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
vsadmin http password vsadmin yes none
vsadmin ontapi password vsadmin yes none
vsadmin ssh password vsadmin yes none
vsadmin-non-97 ssh password vsadmin no totp
4 entries were displayed.
::*> security login totp create -username vsadmin-non-97
Error: command failed: not authorized for that command
Yes, the result is the same.
So, I concluded that as of April 2026, TOTP is not supported as a second authentication factor for SSH connections to Amazon FSx for NetApp ONTAP.
Combination of password authentication as primary authentication / public key as secondary authentication for the fsxadmin user
As a security requirement, there may be cases where MFA is mandatory when authenticating users with administrator privileges.
Another possible method is the combination of password authentication as primary authentication and a public key as secondary authentication.
The official AWS documentation doesn't specifically mention this combination either, but let's try it.
We'll change the authentication method of the fsxadmin user so that the secondary authentication is a public key.
::*> security login modify -vserver FsxId055301943970047df -user-or-group-name fsxadmin -application ssh -authentication-method password -second-authentication-method publickey
Warning: Public key authentication is being setup for user "fsxadmin". This requires creating a public key for the user. After this command completes, use the "security login publickey create" command to create a public key for user "fsxadmin".
::*> security login show
Vserver: FsxId055301943970047df
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
autosupport console password autosupport no none
fsxadmin http password fsxadmin no none
fsxadmin ontapi password fsxadmin no none
fsxadmin ssh password fsxadmin no publickey
fsxadmin-non-97
ssh password fsxadmin no totp
Vserver: svm
Second
User/Group Authentication Acct Authentication
Name Application Method Role Name Locked Method
-------------- ----------- ------------- ---------------- ------ --------------
vsadmin http password vsadmin yes none
vsadmin ontapi password vsadmin yes none
vsadmin ssh password vsadmin yes none
vsadmin-non-97 ssh password vsadmin no totp
9 entries were displayed.
Next, we'll create an arbitrary Ed25519 key pair locally.
> ssh-keygen -t ed25519 -C "fsxadmin"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/<ホームディレクトリ>/.ssh/id_ed25519): ./fsxadmin
Enter passphrase for "./fsxadmin" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./fsxadmin
Your public key has been saved in ./fsxadmin.pub
The key fingerprint is:
SHA256:m4HVHu8Ht4dCeHNJfMVdGCqgQgozshn//tzZ2SKcScg fsxadmin
The key's randomart image is:
+--[ED25519 256]--+
|* . . .+=|
|.O o . o o. +|
|o o . . . + . o .|
| . . o . = . o |
| ....S o * + |
| . E .+ + = o |
| . ooo o + .|
| o .=o.o o . |
| o o.o.. |
+----[SHA256]-----+
> ls -l
total 16
-rw-------@ 1 <ユーザー名> <グループ名> 399 4 29 15:24 fsxadmin
-rw-r--r--@ 1 <ユーザー名> <グループ名> 90 4 29 15:24 fsxadmin.pub
> cat fsxadmin.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEz5J0sXgL0l0Kri0Aje4RQ6gnsCRjHX8L9rdsn5FMYq fsxadmin
We'll register the generated public key.
The registration of public keys was also mentioned in the official AWS documentation.
::*> security login publickey create -vserver FsxId055301943970047df -username fsxadmin -application ssh -publickey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEz5J0sXgL0l0Kri0Aje4RQ6gnsCRjHX8L9rdsn5FMYq fsxadmin"
::*> security log publickey show
Vserver: FsxId055301943970047df
UserName: fsxadmin Application: ssh Index: 0
Public Key:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEz5J0sXgL0l0Kri0Aje4RQ6gnsCRjHX8L9rdsn5FMYq fsxadmin
Fingerprint:
SHA256:m4HVHu8Ht4dCeHNJfMVdGCqgQgozshn//tzZ2SKcScg
Bubblebabble fingerprint:
xesiv-gimeg-petem-fegyz-favag-nofov-fafim-cygys-kagep-hufud-coxix
Comment:
-
Certificate:
-
Certificate Details:
-
Certificate Expiration Status: -
Certificate Revocation Status: -
It's registered.
Now let's try to SSH into the FSxN file system as fsxadmin.
> ssh fsxadmin@management.fs-055301943970047df.fsx.us-east-1.amazonaws.com
fsxadmin@management.fs-055301943970047df.fsx.us-east-1.amazonaws.com: Permission denied (publickey).
> ssh fsxadmin@management.fs-055301943970047df.fsx.us-east-1.amazonaws.com -i ./fsxadmin
(fsxadmin@management.fs-055301943970047df.fsx.us-east-1.amazonaws.com) Password:
This is your first recorded login.
::>
::> whoami
(security login whoami)
User: fsxadmin
Role: fsxadmin
Trust Score: -
You are now asked for both the private key and the password when connecting.
Considering other countermeasures
Let's consider other countermeasures to improve the security level of cluster and SVM management operations provided by NetApp ONTAP.
Specific examples include the following.
- Just in time privilege elevation (JIT-Privilege)
- Multi-Admin-Verify (MAV)
- Dynamic authorization
JIT-Privilege allows users to temporarily elevate their privileges to perform specific tasks.
It is a feature similar to JITNA in SSM Session Manager below.
However, this feature cannot be used at present, because the security jit-privilege commands are not exposed.
::*> security jit-privilege show
Error: "jit-privilege" is not a recognized command
::*> security ?
anti-ransomware> The anti-ransomware directory
audit> Manage administrative audit logging settings
certificate> Manage Digital Certificates
config> *Manage Cluster Security Configuration
dynamic-authorization> The dynamic-authorization directory
ipsec> Manage IPsec
key-manager> Manage Key Management Servers
login> Manage login methods, roles, and passwords
oauth2> The oauth2 directory
protocol> *Manage application configuration
session> Manage CLI, ONTAPI, and REST sessions and view request statistics
ssh> Manage SSH Configuration
ssl> Manage the SSL configurations for a Vserver
MAV is a mechanism that requires approval from other administrators when a user performs a specific operation. This can prevent changes or data deletion caused by malicious operations or erroneous operations.
However, like JIT-Privilege, this cannot be used at present either, because the security multi-admin-verify commands are not exposed.
Dynamic authorization assigns a security score to users and, if their behavior is suspicious, performs additional authorization checks or denies the operation.
This is configured per SVM, so it cannot control the FSxN file system itself.
::*> security dynamic-authorization show
Vserver: svm
Dynamic Authorization State: disabled
Dynamic Authorization Suppression Interval: 10m
Lower MFA Challenge Boundary: 0%
Upper MFA Challenge Boundary: 90%
::*> security dynamic-authorization ?
authentication-history-policy> Manage Authentication history policy
executed-commands> Manage Dynamic Authorization executed commands
group> Manage Dynamic Authorization Group Inclusion/Exclusion
modify Modify dynamic-authorization global settings
rule> Manage Dynamic Authorization Rules
show Show dynamic-authorization global settings
trust-score-component> Manage Dynamic Authorization Trust Score Components
user-trust-score> Manage Dynamic Authorization User Trust Score
::*> security dynamic-authorization modify -state visibility
Error: command failed: not authorized for that command
::*> security dynamic-authorization modify -state visibility -vserver svm
::*> security dynamic-authorization show
Vserver: svm
Dynamic Authorization State: visibility
Dynamic Authorization Suppression Interval: 10m
Lower MFA Challenge Boundary: 0%
Upper MFA Challenge Boundary: 90%
Therefore, it does not lead to protection at the FSxN file system level.
To improve the security of fsxadmin, it seems we'll need to combine password authentication and public key authentication
I have shown that, as of April 2026, TOTP is not supported as a second authentication factor for SSH connections to Amazon FSx for NetApp ONTAP.
It seems that to improve the security of fsxadmin, we'll need to combine password authentication and public key authentication.
Personally, I think JIT-Privilege and MAV would be welcome features in enterprise companies and environments where security is extremely important, so I'd like to see them supported in FSxN as well.
I hope this article helps someone.
This was Non-pi (@non____97) from the Consulting Department, Cloud Business Division!
