Welcome to the NZRT Wiki Podcast. Today we’re looking at Two Factor Auth.

So, what is two-factor authentication, and why does it matter for NZRT? At its core, two-factor auth, or 2FA, means that when you log in to Nextcloud, you don’t just enter your password and walk straight in. You also need to prove your identity a second way. That second step is what makes it so much harder for someone to get into an account even if they’ve somehow got hold of your password.

NZRT supports a few different ways to do that second step, so let’s run through them. There are three methods available.

The first is TOTP, which stands for Time-based One-Time Password. You set it up by scanning a QR code, and from that point on you use an app on your phone like Google Authenticator or Authy to generate a six-digit code whenever you log in. This is the recommended method for most NZRT users.

The second method is Backup Codes. When you set up 2FA, Nextcloud generates ten single-use codes for you. These are for the situation where you’ve lost your phone or can’t access your authenticator app. Generating and securely storing these backup codes is mandatory for everyone using 2FA, not optional.

The third method is FIDO2, which uses a physical USB security key. You plug it in and touch it to authenticate. This one is optional and at NZRT it’s currently only in use by the xc account.

Now, how does NZRT actually enforce 2FA for people who need it? Through the Nextcloud admin settings, under the Security section, an administrator can turn on enforcement for specific groups. At NZRT that means the admin group, the finance group, and the HR group. When enforcement is switched on, anyone in those groups sees a prompt to set up 2FA the next time they log in. There’s also a grace period of seven days, which gives users a window to get it configured before they’re locked out of their workflow.

Let’s walk through what the TOTP setup actually looks like from a user’s perspective. First, you head into your Account Settings and enable 2FA. Nextcloud then shows you a QR code. You open Google Authenticator or Authy on your phone and scan that code. The app will immediately start showing you a six-digit number that changes every thirty seconds. You type that number into Nextcloud to confirm the link worked. Then, crucially, you save your backup codes somewhere safe, a password manager or a secure printed copy somewhere offline. From that point on, every time you log in you’ll enter your password as usual, and then you’ll be asked for the current six-digit code from your app.

So who at NZRT actually needs to do this? The policy splits into three tiers. Two-factor auth is mandatory for three accounts: xc, which is the admin account; fin, the finance role; and han, the HR role. It’s strongly recommended for two more: ema, who handles email and digital marketing, and dan, the database administrator. For everyone else in the organisation, 2FA is optional but still a good idea.

Why are finance and HR singled out as mandatory rather than just recommended? Because those roles handle sensitive personal and financial data. Data protection regulations require that access to that kind of information is properly secured, and relying on a password alone doesn’t meet that bar. If a credential gets compromised, whether through a phishing email, a reused password, or a data breach somewhere else, 2FA is the thing that stops an attacker from just walking in. The second factor, the code on your phone or the key you have to physically touch, is something an attacker very rarely has even when they have your password.

The broader point here is that 2FA isn’t about distrust of users. It’s about recognising that passwords alone are no longer a reliable defence. Credential compromise is one of the most common causes of account breaches, and adding that second step dramatically reduces the risk for the accounts that matter most.

If you’re in one of the mandatory groups and you haven’t set this up yet, now is the time. Head into your Nextcloud account settings, find the security section, and follow the TOTP setup steps. Make sure you save those backup codes. And if you have any questions, check the related notes in the wiki covering Users and Groups, Permissions and Sharing, and the Administration Overview.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.