Author: Anna Korobkyna

Protectimus Bots are used for delivering one-time passwords (OTPs) and important notifications from the Protectimus Two-Factor Authentication System to end users. These chatbots, named Protectimus Bot, are available on Facebook Messenger, Telegram, and Viber. The list of supported messaging applications is constantly growing and can be expanded upon request from our clients. OTP delivery through messaging apps addresses several key issues: it is much more secure than SMS authentication, completely free, and easy to use.

1. Login to Your Protectimus Account and Add Resource

1. Login to your account in Protectimus SAAS Service or On-Premise Platform and go to the Resources page.

2. Click the Add Resource button.

3. This will take you to the Resource adding page, where you’ll need to specify just a Resource Name and click Save, the remaining parameters are optional.

• Webhook URL. Whenever there is an update for the Resources, we will send a POST request containing a JSON update to the specified webhook URL. In case of an unsuccessful request, we will give up only after a reasonable amount of attempts. Currently, webhook is used to receive the result of INTERACTIVE authentications. INTERACTIVE authentications are supported by Protectimus Bot token.
• SSL certificate. The public key certificate certifies the belonging of the public key to the indicated webhook. The certificate supplied should be PEM encoded (ASCII BASE64), The pem file must contain only the public key beginning with “—–BEGIN CERTIFICATE—– ” and end with “—– END CERTIFICATE —–“
• Allowed IP Addresses. Allows you to restrict access to the system only from trusted IP addresses.
• IP Verification is Enabled. Enables the restriction of access to the system only from trusted IP addresses.
• Number of Unsuccessful Login Attempts before Locking. The value of this parameter should be specified between 3 and 10. If a User or Token is not authenticated successfully, the number of failed authentication attempts will be increased for this User. When the threshold number of failed attempts for the specified Resource is exceeded, this User will be locked. A User can be unlocked through the web interface or the API (the edit user method). If a User is authenticated successfully, the number of failed authentication attempts will be set at zero, if the threshold number of failed attempts for the specified resource is not exceeded, and if this User has not yet been locked.
• Enabled. Allows you to enable or disable the Resource.

2. Activate Users’ Self-Service Portal

1. Go to the Resources tab, click on the resource name, and navigate to the Self-Service tab.

2. If you haven’t enabled the Self-Service Portal for your users yet, click on Enable User’s Self-Service for your resource.

3. Specify the address at which your users will access the Self-Service Portal.
   
   Enter just the final portion of the address, the portal alias, in the field. The full address to the portal will be the authentication server address plus the alias you specified. For example, if you’re using the Protectimus SaaS service, and you specify “portal” as the alias, the link you give to your users will look like this: https://service.protectimus.com/selfservice/portal
   
   If you are running your own instance of the authentication platform on your own premises, the “service.protectimus.com” portion of the address will be replaced with the address to your platform instance. For example: https://localhost:8080/selfservice/portal.

4. Set up the list of actions available to your users in the self-service portal.
   
   You’ll see the list of actions available to your users, as shown in the image below. By default, all actions are disabled.
   
   Enable the action Register New Token. Then you’ll need to specify the Token types for enroll token, if your users will use only Protectimus Bots, leave only Protectimus Bot.

3. Add Users and Specify Their Passwords or Emails

1. Go to the Users page.

2. Click the Add User button.

3. Set the user Login. The User Login must contain only Latin letters, numbers, and symbols _-@∽!#%+.$. Spaces and any other symbols are not allowed.
   
   Also set a password or an email address. A verification code will be sent to the registered email address to allow your users to log into the Self-Service Portal. If a User has both a password and a registered email address, that User will use the password to log in. After a Token is issued for a User and assigned to a Resource, the User will also be asked for an OTP password from the Token when logging in to the Users’ Self-Service Portal.

PLEASE NOTE! You can import users. Detailed instructions on importing users are available here – https://www.protectimus.com/guides/users/#2-how-to-import-users. Make sure that your Users have specified passwords or email addresses.

4. Assign Users to the Resource

1. Go to the Resources page.

2. Find the Resource you need, click Assign, then Users. And assign all necessary Users to this Resource. Users must be assigned to an appropriate Resource in order to have access to the Self-Service Portal.

5. Provide Your Users With Instructions on How to Access the Protectimus Self-Service Portal

1. Give your users a URL to access the Self-Service Portal.

2. Inform your users what usernames and passwords / emails should they use to access the Users Self-Service Portal.

6. Provide Your Users With Instructions on How to Add the Protectimus Bot

1. Log into the Protectimus Self-Service Portal using your username and password or email (contact your administrator for more info if you have any questions).
2. Choose Register New Token.

3. Then choose Bot Token.

4. Enter the token name (any name you want).
5. Open the messaging app you prefer: Facebook Messenger, Telegram, or Viber.
6. Find the ProtectimusBot chatbot using the built-in search (built-in search works only for Telegram) or use the link:
   
   

   Please note: To find the ProtectimusBot chatbot on Facebook Messenger and Viber, users will need to use a direct link, as the built-in search feature doesn’t work for these messaging apps.

   • For Facebook Messenger: http://m.me/ProtectimusBot
   • For Telegram: https://t.me/protectimusbot
   • For Viber: viber://pa?chatURI=Protectimus
7. Send the command /getid to the ProtectimusBot to receive a unique chat ID.
8. Input the received chat ID into the field User’s Chat ID.
9. Indicate which messaging app you’ve chosen in the field Messenger.
10. Don’t change anything in the field One-time Password Length.
11. Click Save.

12. After that, you will receive the one-time password in the messaging app you’ve chosen. Enter it into the field One-time Password and click Save.

13. If everything was done correctly, you will see the message: The token has been successfully created.

1. How to Enable Multi-Factor Authentication for NComputing vSpace

You can set up multi-factor authentication (2FA) for NComputing vSpace with Protectimus using the RADIUS protocol:

1. Get registered with Protectimus SAAS Service or install the On-Premise 2FA Platform and configure basic settings.
2. Install and configure Protectimus RADIUS Server.
3. Add Protectimus as RADIUS Server for NComputing vSpace.

2. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

3. Install and Configure Protectimus RADIUS Server

4. Add Protectimus as RADIUS Server for NComputing vSpace

1. Access your NComputing vSpace dashboard and navigate to the RADIUS Server Settings section.


2. Input the details as specified below:
   

   Label	Come up with a name for your RADIUS server.
   Hostname/Address	IP of server where the Protectimus RADIUS Server component is installed.
   Authentication Port	Indicate 1812 (or whichever port you configured in the Protectimus radius.yml file when configuring Protectimus RADIUS Server).
   Authentication Type	PAP authentication is required.
   Shared Secret Code	Indicate the shared secret you created in the Protectimus radius.yml file (radius.secret property) when configuring Protectimus RADIUS Server.
   Server Timeout (in seconds)	Set to 90 seconds.
   Max Attempts	This specifies how many times the authentication request should be sent. Set to 1.



3. Click Save and test the integration.

1. How to Enable Multi-Factor Authentication for Nerdio

You can set up multi-factor authentication (2FA) for Nerdio with Protectimus using the RADIUS protocol:

1. Get registered with Protectimus SAAS Service or install the On-Premise 2FA Platform and configure basic settings.
2. Install and configure Protectimus RADIUS Server.
3. Add Protectimus as RADIUS Server for Nerdio.

2. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

3. Install and Configure Protectimus RADIUS Server

4. Add Protectimus as RADIUS Server for Nerdio

1. Access your Nerdio dashboard and navigate to the RADIUS Server Settings section.


2. Input the details as specified below:
   

   Label	Come up with a name for your RADIUS server.
   Hostname/Address	IP of server where the Protectimus RADIUS Server component is installed.
   Authentication Port	Indicate 1812 (or whichever port you configured in the Protectimus radius.yml file when configuring Protectimus RADIUS Server).
   Authentication Type	PAP authentication is required.
   Shared Secret Code	Indicate the shared secret you created in the Protectimus radius.yml file (radius.secret property) when configuring Protectimus RADIUS Server.
   Server Timeout (in seconds)	Set to 90 seconds.
   Max Attempts	This specifies how many times the authentication request should be sent. Set to 1.



3. Click Save and test the integration.

1. How to Enable Multi-Factor Authentication for NetApp Virtual Desktop Service

You can set up multi-factor authentication (2FA) for NetApp VDS with Protectimus using the RADIUS protocol:

1. Get registered with Protectimus SAAS Service or install the On-Premise 2FA Platform and configure basic settings.
2. Install and configure Protectimus RADIUS Server.
3. Add Protectimus as RADIUS Server for NetApp Virtual Desktop Service.

2. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

3. Install and Configure Protectimus RADIUS Server

4. Add Protectimus as RADIUS Server for NetApp VDS

1. Access your NetApp Virtual Desktop Service dashboard and navigate to the RADIUS Server Settings section.


2. Input the details as specified below:
   

   Label	Come up with a name for your RADIUS server.
   Hostname/Address	IP of server where the Protectimus RADIUS Server component is installed.
   Authentication Port	Indicate 1812 (or whichever port you configured in the Protectimus radius.yml file when configuring Protectimus RADIUS Server).
   Authentication type	PAP authentication is required.
   Shared secret code	Indicate the shared secret you created in the Protectimus radius.yml file (radius.secret property) when configuring Protectimus RADIUS Server.
   Server timeout (in seconds)	Set to 90 seconds.
   Max attempts	This specifies how many times the authentication request should be sent. Set to 1.



3. Click Save and test the integration.

1. How to Enable Multi-Factor Authentication for Parallels RAS

You can set up multi-factor authentication (2FA) for Parallels RAS with Protectimus using the RADIUS protocol:

1. Get registered with Protectimus SAAS Service or install the On-Premise 2FA Platform and configure basic settings.
2. Install and configure Protectimus RADIUS Server.
3. Add Protectimus as RADIUS Server for Parallels Desktop.

2. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

3. Install and Configure Protectimus RADIUS Server

4. Add Protectimus as RADIUS Server for Parallels RAS

1. Access your Parallels RAS Application Server Console and navigate to:
   Connection –> Multi-Factor authentication –> + (plus) icon in the upper-right corner –> RADIUS –> RADIUS…
   
   
   
   
2. In the upcoming window, provide the following details:
   • Name: Select a name for your RADIUS server, such as Protectimus RADIUS Server.
   • Description: This field is optional and enables you to include a description for your RADIUS server if desired.
   • Themes: Ensure to choose the “Default” option.
   
   
   
   
3. Click Next and proceed to fill in the details regarding your RADIUS server. Please consult the provided image and table for reference.
   

   Display Name	Come up with a name for your RADIUS server.
   Primary Server	IP of server where the Protectimus RADIUS Server component is installed.
   Secondary Server	Simply leave it blank.
   HA Mode	Simply leave it blank.
   Port	Indicate 1812 (or whichever port you configured in the Protectimus radius.yml file when configuring Protectimus RADIUS Server).
   Timeout	Set to 60 seconds.
   Retries	Set to 3.
   Secret key	Indicate the shared secret you created in the Protectimus radius.yml file (radius.secret property) when configuring Protectimus RADIUS Server.
   Password encoding	Choose PAP.

   
   
   
   
4. All remaining options are voluntary. Click Finish and save your configuration.

Please note: Configuring MFA for Parallels RAS is unique. By default, the RADIUS MFA provider only supports the TOTP authentication method, which includes Protectimus hardware TOTP tokens or the 2FA app Protectimus SMART OTP. Enabling SMS, chatbot, or email authentication may require additional setup. If you need assistance with these authentication methods, please contact our support team.

The Protectimus User’s Self-Service Portal lets users handle various tasks independently, such as enrolling and managing their security tokens and personal information. The system administrator decides which tasks users can do.

Please note:

1. The Self-Service Portal must be enabled and configured separately for each resource.
2. Users must be assigned to an appropriate Resource in order to have access to the Self-Service Portal.
3. Users must additionally have a password in Protectimus system or an email address on record. A verification code will be sent to the registered email address to allow users to log into the Self-Service Portal. If a user has both a password and a registered email address, that user will use the password to log in.
4. After a token is issued for a user and assigned to a Resource, the user will also be asked to input a password from the token when logging in.

1. Activate the Protectimus User’s Self-Service Portal

1. Log into your account in Protectimus SAAS Service or On-Premise Platform. Then, go to the Resources tab, click on the resource name, and navigate to the Self-Service tab.

2. If you haven’t enabled the Self-Service Portal for your users yet, click on Enable User’s Self-Service for your resource, and specify the address at which your users will access the Self-Service Portal.

2. Set Up the Protectimus User’s Self-Service Portal

2.1. If you use the Protectimus Cloud Service

• Register New Token. This feature lets users create, issue, and assign themselves tokens. When you activate this option, users will see a list of token types they can access through the portal. You can choose to enable only the types of tokens you intend to use, preventing users from being overwhelmed by too many options. Once a user creates a token, it will be linked to this resource as a “token with user.” Afterward, the user will need to input a one-time password from the token every time they log into the portal.
• Existing Token Registration. Allows users to confirm that they have received a token. Helpful when using physical tokens. After receiving a set of tokens, assign them to a resource and distribute them to your users as you wish. When users receive their tokens, they can input their serial numbers on their own and confirm the tokens are in their possession with one-time passwords.
• Re-Assign Token. Allows users to exchange an existing token for a new one. After performing this action, the old token will be unavailable.
• Unassign Token. Allows users to unlink a token with a user from a resource. The user will remain associated with the token. In effect, the resource assignment is changed from “token with user” to just “user.”
• Token Synchronization. Allows users to synchronize tokens if the time or counter on the device has become desynchronized from the server (more relevant for hardware tokens using TOTP and OCRA algorithms). Used primarily with physical tokens. Protectimus Smart has a built-in synchronization feature. It’s important to note that Protectimus Smart synchronizes itself with the time on Protectimus servers. If you have your own platform, be sure to set the time on it correctly.
• PIN Setup. Allows users to add a PIN to a token. When this feature is enabled, users are required to enter a four-digit code either before or after the OTP itself, depending on their settings. For example, if a user chooses “1111” as a PIN and chooses to enter the PIN after the OTP, and the user’s token generates “123456” as a one-time password, the user must input the following combination into the OTP entry field: “1234561111”.
• Remove PIN. Allows users to turn off the PIN feature.
• Create Password. Allows users to create a Protectimus password.
• Change Password. Allows users to change their Protectimus passwords.
• Change Email Address. Allows users to change the email address registered with Protectimus.
• Change Contact Phone Number. Allows users to change their phone number registered with Protectimus.
• Change Login. Allows users to change their Protectimus usernames. Important: when integration with other services has been set up, links between systems are usually login-based. For this reason, if users change their logins on only one system, Protectimus may become unable to identify them. This may also break business logic when communicating with third-party services.
• Change First Name and Last Name. Allows users to change their first and last name registered with Protectimus.
• Manage User Environment: Experimental feature for smart user identification. When logging into the system, the degree of correspondence between the user’s current environment and the environment they typically log in from will be evaluated.

2.2. If you use the Protectimus On-Premise Platform

• Federated Auth: Users log into the Self-Service Portal using their password from Active Directory (AD). If enabled, setting the user’s password within the Protectimus Platform is not required.
• Auth via Security Questions: Users log into the Self-Service Portal by answering secret questions.
• Password Auth: Users log into the Self-Service Portal using the password set in the Users’ settings within the Protectimus Platform.
• Email Auth: Users log into the Self-Service Portal using a one-time code sent to the email specified in the Users’ settings within the Protectimus Platform.

• Password Policy: This feature allows you to set policies for users, enabling them to change/create a password themselves after logging into the Self-Service Portal.
• Change Federated Password: By enabling this feature, you grant users permission to change their AD password through the Self-Service Portal. To change the AD password, they will need to specify both the old and new AD passwords.
• Reset Federated Password: Enabling this feature grants users permission to reset the AD password through the Self-Service Portal, requiring only the specification of the new password.

NOTE:

1. Changing the password in AD using the Self-Service Portal works only via LDAPS (SSL) connection; it does not work via LDAP.
2. The option to change passwords in AD using the Self-Service Portal is available exclusively for users synchronized from AD; it is not applicable to DSPA users.

3. Give Your Users Access to Protectimus User’s Self-Service Portal

1. Either a password or an email registered in the Protectimus platform.
   Users with both a password and a registered email address will use the password. For those with only an email, a verification code will be sent to the registered email address. If necessary, you can add passwords or emails in User settings.

2. The link specified when enabling the Self-Service Portal.
   
   Users should follow this link to log into their Self-Service Portal account, where they will see the available actions. Then, they should click the respective button and follow the required sequence of steps to complete their chosen action.
   
   

1. Log in to your Volet account and navigate to the Security Settings page.
   
   

2. Scroll down to the Two-Factor Authentication (2FA) settings and click the CONFIGURE button.

3. Choose your preferred two-factor authentication method for receiving one-time passwords.
   There are two options:
   • Install the free 2FA app Protectimus SMART OTP, which is available for iOS and Android.
   • Set up a 2FA chatbot on Telegram, Viber, or Facebook Messenger.

1. Setting up the Protectimus SMART OTP Authenticator App

1. If you plan to use the Protectimus SMART OTP authenticator app for generating one-time passwords, select the Token option and click on CONFIGURE.

2. Next, press the SOFTWARE TOKEN button.

3. At this stage, you will need the Protectimus SMART OTP application. Download the application from Google Play Store if you are using an Android phone, or from App Store if you are using an iOS phone.
   
   The application is available for free. To download, use the provided link or scan the corresponding QR code below.

4. After installing the application, open it. You will see the welcome screen. Press Continue.

5. Next, you will be prompted to activate Cloud Backup.
   
   We strongly recommend using the cloud backup feature to ensure the preservation of your OTP tokens in case of loss, phone damage, or accidental deletion of the two-factor authentication app.
   
   To activate cloud backup, select the Cloud Backup option.
   
   
   
   
   Select your account in Google Cloud or iCloud and log in if necessary, providing all the required permissions.
   
   Set a password for the backup file – it can be any password from 3 to 16 characters. Enter the password, repeat it, and press Continue.
   
   After activating cloud backup, press Continue to proceed to token enrollment.
   
   
   
   

6. Now you can add a new token. Click on the Add new token button.
   
   
   
   
   Select Scan QR code.
   
   
   
   
   Point your smartphone camera at the QR code displayed on the Volet page.
   
   
   
   The application will scan the QR code containing the secret key and enroll the token.
   
   

   Note: In case you’re unable to scan the QR code for any reason, you also have the option to manually add the secret key to the application.

   
   
   
   

7. Enter the one-time password displayed in the application into the corresponding field in Volet and click the ACTIVATE button.

8. You have successfully registered a two-factor authentication token for your Volet account. From now on, each time you log in, you will start by entering your standard username and password, followed by the one-time password generated by the Protectimus Smart OTP application.



Note: Do not uninstall the application from your smartphone. If you want to deactivate or remove the token from your Volet account, you will also need to enter a one-time password.

1.1. How to Manually Add a Secret Key to the Protectimus Smart OTP App

1. Click on the “Can’t scan the QR code?” option on your Volet Software Token settings page.

2. A secret key will be displayed, which you need to add to the Protectimus Smart OTP App.

3. In the Protectimus Smart OTP App, click on the Add new token button.
   
   
   or
   
   
   

4. Select Add token manually.

5. Fill in the required fields:

Issuer:	Volet
Login:	This is the name of the token; add any name you wish.
Additional Information:	You may leave this field empty or add a note if you wish.
Token key:	Enter the secret key from your Volet Software Token settings page (without empty spaces).
Protectimus checksum:	Leave as it is.
OTP Type:	Leave as it is – By time (TOTP).
Algorithm:	Leave as it is – SHA1.
OTP Length:	Leave as it is – 6 digits.
OTP Lifetime:	Leave as it is – 30 seconds.




Save the changes by tapping the Add token button in the upper right corner.

6. Enter the one-time password displayed in the application into the corresponding field and click the ACTIVATE button.

7. You have successfully registered a two-factor authentication token for your Volet account. From now on, each time you log in, you will start by entering your standard username and password, followed by the one-time password generated by the Protectimus Smart OTP application.
   
   

   Note: Do not uninstall the application from your smartphone. If you want to deactivate or remove the token from your Volet account, you will also need to enter a one-time password.

2. Additional Protectimus SMART OTP Application Settings

• Encrypted cloud backup;
• Ability to transfer tokens to a new phone;
• Ability to import tokens from Google Authenticator;
• PIN and biometric authentication protection (Touch ID and Face ID);
• Support for all OATH one-time password generation algorithms (HOTP, TOTP, and OCRA);
• 6 and 8 digit one-time passwords;
• Multiple language support: English, French, German, Italian, Spanish, Russian, and Ukrainian;
• Convenient distribution of OTP tokens by folders;
• Customization of tokens with different emojis and descriptions.

2.1. Adding Tokens for Other Accounts or Websites

1. To add a new token, open the Protectimus Smart OTP two-factor auth app and tap on the plus sign in the upper left corner.

2. You can choose to add the token by scanning a QR code or by entering the secret key manually.
   
   If you choose to Scan QR code, simply point your smartphone’s camera at the code on the security settings page of the website you want to protect with two-factor authentication. The app will automatically scan the QR code and create a token.

3. If you choose to Add token manually, you’ll need to enter the token name (Login), the secret key (Token key), choose the OTP generation algorithm (OTP Type), the one-time passwords length, and lifetime. Then save the changes tapping the Add token button in the right upper corner.
   
   

   Note that if you’re using a two-factor authentication system other than Protectimus, you should uncheck the Protectimus checksum checkbox.

2.2. Editing and Deleting Tokens in the Protectimus SMART OTP App

1. To edit or delete a token, long-press on its name and choose the desired action. Alternatively, you can open the Edit Token menu by tapping the pen icon in the upper-right corner and selecting the token you want to modify.

2. Once you’re in the Edit Token menu, you can customize the token by:
   • changing its emoji,
   • setting the issuer,
   • updating its name (Login),
   • adding a description (Additional information),
   • adjusting the OTP length,
   • assigning it to a folder.
   If you need to remove the token entirely, there’s an option to delete it.
   
   Once you’ve made your changes, click Save and close in the upper-right corner to confirm.

2.3. Grouping Tokens by Folders

1. To keep your tokens organized, you can group them into folders.
   
   To add a token to a folder, simply long-press its name and select Add to folder.

2. You’ll be taken to the folder settings menu, where you can either choose an existing folder or create a new one. If you want to create a new folder, click on the icon in the top right corner.

3. To manage your folders, click on the gear icon in the upper right corner to go to the Settings page.

4. Select Folder Settings.

5. From here, you can edit, delete, and create new folders, as well as edit tokens in any folder.

2.4. Changing the Order of Tokens

1. To do so, open the Edit Token menu by tapping the pen icon in the upper-right corner.

2. From there, simply drag the tokens to rearrange them in the desired order. Save the changes by clicking on the checkmark in the upper right corner.

2.5. Cloud Backup

1. Go to Settings.

2. Tap Backup in cloud.

3. If the backup function is not activated yet, enable it.

4. If the backup function has been activated and you have made any changes, you can Restore the previous version or Update the backup file. Tap the Upload button to upload the latest changes to the cloud.

5. You will see the allert message. If you are sure that you want to upload current OTP tokens in the cloud, tap Update. Please note that this will erase previous backup.

Please note! To secure you backup file, we recommend adding a password, use the Add backup file password button.

2.6. App Security (PIN and Biometric Authentication)

1. Go to the Settings menu.

2. Select App security.

3. Create a unique PIN for the application.

4. The app will prompt you to allow biometric authentication for easier access.

5. Once both PIN and biometric protection are enabled, you can manage your PIN, and turn biometric authentication on or off from the App security page.

2.7. Transferring Tokens to a New Phone

1. To get started, simply navigate to the Settings menu.

2. Tap on the Data transfer option.

3. If you want to transfer tokens from your current device to another, choose Export tokens. Alternatively, if you want to import saved data onto your device, select Import tokens.

4. If you choose to export tokens, create a strong password and click on Continue to generate the file containing all your data.

5. Remember to save this file so you can import your tokens onto the new device later.

2.8. Importing from Google Authenticator

• tap the menu button located at the top-right corner;
• select Transfer accounts;
• then choose Export accounts;
• select the tokens you wish to transfer to Protectimus Smart OTP;
• tap Next, and you will see a QR code, scan this QR code using the Protectimus Smart OTP app.

1. Go to Settings.

2. Select Import from Google Authenticator, scan the QR code generated by Google Authenticator and wait for the import process to complete.

2.9. Time Correction

1. Navigate to Settings.

2. Select the Time correction option.

3. If everything is in order, you will see a message confirming that the time is already correct.

2.10. Application Language

2.11. Screen Capture Access

2.12. Changing Light and Dark Appearance

3. Setting up 2FA Chatbot on Telegram, Viber, or Messenger

1. If you’re opting for the two-factor authentication chatbot on Telegram, Viber, or Facebook Messenger, select the Chat Bots option and click CONFIGURE.

2. Choose the messaging app you prefer and find the ProtectimusBot chatbot within the messaging app.
   • Telegram – find ProtectimusBot by using the built-in search or use this link https://t.me/protectimusbot.
   • Facebook Messenger – find ProtectimusBot through the app’s search function or click http://m.me/ProtectimusBot.
   • Viber – copy the link viber://pa?chatURI=Protectimus, add it to your Notes in Viber to make it clickable, then click it to open the Protectimus chatbot in Viber.

3. Click CONFIGURE.

4. Enter the /getid command in the chatbot.
   
   Afterward, you will see your chat ID, which needs to be added to the Volet system for token enrollment.

5. Enter the chat ID you received into the corresponding field in Volet and click SEND.

6. Then, enter the one-time password from the Protectimus chatbot to complete the token registration.

4. How to Delete or Deactivate a Two-Factor Authentication Token in Volet

1. Navigate to the Security Settings page.

2. Scroll down to the Two-Factor Authentication (2FA) settings and click the CONFIGURE button.

3. Click on CHANGE SETTINGS for the two-factor authentication method you use.

4. If you are deactivating or deleting the Protectimus Smart OTP software token, click on the SOFTWARE TOKEN button.

5. Choose whether you would like to DEACTIVATE or DELETE the token.



• If you DEACTIVATE the token, you can activate it again; for this, you’ll need the one-time code from your token.
• If you DELETE the token, you cannot reactivate it; you’ll need to enroll a new one.

6. Enter the one-time password and click CONFIRM.

1. To log in to your Windows account, enter your username and password as usual.


2. After that, you will see the token auto-registration window. Click on the Show QR button.

3. At this stage, you will need the Protectimus SMART OTP application. Download the application from Google Play Store if you are using an Android phone, or from App Store if you are using an iOS phone.
   
   The application is available for free. To download, use the provided link or scan the corresponding QR code below.

4. After installing the application, open it. You will see the welcome screen. Press Continue.

5. Next, you will be prompted to activate Cloud Backup.
   
   We strongly recommend using the cloud backup feature to ensure the preservation of your OTP tokens in case of loss, phone damage, or accidental deletion of the two-factor authentication app.
   
   To activate cloud backup, select the Cloud Backup option.
   
   
   
   
   Select your account in Google Cloud or iCloud and log in if necessary, providing all the required permissions.
   
   Set a password for the backup file – it can be any password from 3 to 16 characters. Enter the password, repeat it, and press Continue.
   
   After activating cloud backup, press Continue to proceed to token enrollment.
   
   
   
   

6. Now you can add a new token. Click on the Add new token button.
   
   
   
   
   Select Scan QR code.
   
   
   
   
   Point your smartphone camera at the QR code you see on the Windows account login page.
   
   
   
   The application will automatically scan the QR code and create the token.
   
   
   
   
   

7. Enter the one-time password that you see in the application
   
   
   
   into the Windows one-time password input field, and press Enter.
   
   
   
   

8. You have successfully logged into your Windows account and created a token. Now, every time you log into Windows, you will need to enter your standard username and password first, followed by the one-time password from this application. Don’t delete the application.
   

1. How Two-Factor Authentication for pfSense OpenVPN Works

1. Their username and password (something the user knows).
2. A unique one-time password generated through a hardware OTP token, 2FA chatbot, or a smartphone app (something the user possesses).

2. How to Enable 2FA for pfSense OpenVPN

You can set up 2-factor authentication (2FA) for pfSense OpenVPN with Protectimus using the RADIUS protocol:

1. Get registered with Protectimus SAAS Service or install the On-Premise 2FA Platform and configure basic settings.
2. Install and configure Protectimus RADIUS Server.
3. Add Protectimus as RADIUS Server for pfSense OpenVPN.

2.1. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

2.2. Install and Configure Protectimus RADIUS Server

2.3. Add Protectimus as RADIUS Server for pfSense OpenVPN MFA

Important Note:
The built-in FreeRADIUS within pfSense has a limited range of settings and does not permit the specification of the user email attribute. Due to this limitation, you cannot employ the internal FreeRADIUS for this integration. Instead, opt for a separate FreeRADIUS installation or select any other Identity Provider mentioned in the preceding section.

1. Launch a web browser and access the pfSense WebGUI.
2. Navigate to System –> Package Manager. Switch to the Available Packages tab.
3. Find openvpn-client-export and select Install. Confirm your action by clicking the Confirm button. After a brief moment, you’ll receive confirmation of a successful installation. The package should now be visible within the Installed Packages tab.

4. Access the System –> User Manager section.
5. Move to the Authentication Servers tab and proceed to Add.

6. Complete the form, using the table below for additional guidance on the settings. Once done, click Save to add the Authentication Server.

7. Select the Save option.
8. Navigate to VPN –> OpenVPN. Locate your interface within the list of OpenVPN Servers. Click on the pencil icon situated on the right side.

9. Transition to the Servers tab. Confirm that the Server mode is configured as Remote Access (User Auth).
10. Verify that the Backend for authentication is configured to the Authentication Server generated in Step 6.

11. The remaining settings should be adjusted according to your specific requirements. Click on Save to preserve the modifications.
12. Transition to the Client Export tab. Proceed to Advanced –> Additional configuration options.
13. Integrate the reneg-sec 0 option into Additional configuration options.
    
    The reneg-sec n option grants you the ability to modify the duration (in seconds) before a data channel key renegotiation takes place. Adjust it to 0 in order to avoid the need for re-authentication as long as you remain connected without any disconnections.

We highly advise configuring reneg-sec as 0. If an alternate value is chosen, there’s a possibility that your users will encounter 2FA reauthentication prompts once the time defined by that value elapses.

By default, this value stands at 3600 seconds. Therefore, without incorporating the reneg-sec 0 option and leaving the Additional configuration options blank, your users will be prompted to reauthenticate every hour.

14. Within the Additional configuration options, include the hand-window 120 option. This choice guarantees the accurate timeout of the authentication process in situations where a user is unable to complete 2FA within the designated timeframe.
15. Utilize the Save as default button to preserve this alteration as the default setting.

16. Navigate further down to the OpenVPN Clients section, and select the suitable download button in accordance with your requirements. While the Windows Installer is a commonly chosen option, you have the flexibility to opt for any of the provided choices.

17. At this point, you possess a suitable installation file or package tailored for your OpenVPN users. Your configuration process is now finished. Following the installation of the package, your users will experience enabled Protectimus two-factor authentication during their VPN login process.

1. Users attempting to connect to the Wi-Fi network will be prompted to enter their phone number.
2. A unique one-time password is sent to the user via SMS.
3. The user enters the received one-time password in the designated field.
4. Protectimus verifies the one-time password and either grants or denies access to the Wi-Fi network based on the authentication result.

1. Get Registered and Configure Basic Protectimus Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform (if you install Protectimus Platform on Windows, check the RProxy box during the installation).
2. Add Resource.

2. Install the Protectimus Unifi Guest Portal Server Using a Docker Image

1. To start installing the Protectimus Unifi Guest Portal Server, first of all, download and install docker and docker-compose:

• Docker: https://docs.docker.com/engine/install/
• Docker-compose: https://docs.docker.com/compose/install/

2. Then clone the git repository: https://github.com/protectimus/platform-linux.git

3. Once you have successfully cloned the git repository, edit the file located at unifi-guest-portal/config/guest-portal.yml, and incorporate the properties detailed in the third paragraph.

4. Go to the unifi-guest-portal directory and run:

docker-compose up -d

5. You can monitor the process of Protectimus Unifi Guest Portal Server deployment using the command:

docker-compose logs -f

6. There is also an additional file fragments.html, it is needed to customise the UI of the login screen.

7. After the deployment process is complete, the Protectimus Unifi Guest Portal Server will be available at: https://localhost:8080.
   You can modify the port in the configuration file (unifi-guest-portal/config/guest-portal.yml).

3. Configure Protectimus Unifi Guest Portal Authentication Server Settings

3.1. Guest Portal Server Settings

server:
  port: 8888
  ssl:
    enabled: true
    key-store-type: PKCS12
    key-store: classpath:keystore/guest-portal.p12
    key-store-password: password
    key-alias: guest-portal

port:

ssl:

3.2. Unifi Settings

unifi:
  cookie-expiration-time: 30000
  base-url: https://localhost:8443
  username: admin
  password: admin
  sites-verification-enabled: true
  sites:
    - default
  session:
    duration-minutes: 90
    download-speed: 2048
    upload-speed: 640
    quota: 4096
  redirect-page: https://www.google.com

cookie-expiration-time:

base-url:

username:

password:

sites-verification-enabled:

sites:

session:

redirect-page:

3.3. Protectimus API Settings (setting up connection to the PROTECTIMUS service)

protectimus-api:
  login:
  api-key:
  url: https://api.protectimus.com/
  resource-id: 

login:

api-key:

url:

resource-id:

3.4. Report Settings

report:
  csv:
    params:
      - action
      - id
      - ip
      - ap
      - ssid
      - time
      - phoneNumber
    date-format: 'yyyy-MM-dd HH:mm:ss z'
    zone-id: UTC

csv:

params:

date-format:

zone-id:

3.5. An Example of guest-portal.all.yml file

server:
  port: 8888
  ssl:
    enabled: true
    key-store-type: PKCS12
    key-store: file:guest-portal.p12
    key-store-password: password
    key-alias: guest-portal

unifi:
  base-url: https://localhost:8443
  username: admin
  password: admin
  sites:
    - default

protectimus-api:
  login: [email protected]
  api-key: secret
  url: https://api.protectimus.com/
  resource-id: 1

logging:
  level:
    com.protectimus: INFO

4. Configure Ubiquiti UniFi Controller

4.1. Create a Guest User Group

1. Navigate to Settings –> User Groups.
2. Select Create New User Group.
3. Assign the group a name, such as Guests.
4. Set the upload and download bandwidth limits. For basic internet browsing, 5mbps download and 1mbps upload should suffice. However, if you want to enable streaming, ensure a minimum of 10mbps download.
5. Click Save to apply the changes.

4.2. Create a Wireless Unifi Guest Network

• Pre and Post-Authorization Access: This means guests can use the network’s login page to sign in. But once they are logged in, they won’t be able to access the main network.
• Client Isolation: This feature stops guests from sending messages to other guests on the same network. It keeps their communication private and secure.

1. Open the Unifi Controller.
2. Navigate to Settings –> Wireless Networks.
3. Click on Create New Wireless Network.
4. Give the network a name that guests will easily identify as the guest network.
5. Set the security to open for now, as we will later secure it with a captive portal.
6. Select Apply guest policies (captive portal, guest authentication, access).
7. Expand the Advanced Options.
8. Choose the User Group you just made.

4.3. Set Up the Guest Policies

1. Enable the Guest Portal.
2. Select External portal server.
3. Enter the IP address of the Protectimus Unifi Guest Portal Authentication Server in the IPv4 Address field.
4. Choose Redirect using hostname and provide the URL of the page that the client will attempt to open after successful authentication on the guest portal (e.g., google.com).
5. The Pre-Authorization Access field is typically left blank as the default setting.
6. For the Post-Authorization Restrictions, enter the subnet of your local network. By default, all possible local network addresses are blocked, so you can leave this as it is. However, if you want to grant guests access to specific devices like a printer while restricting access to the rest of your network, you can set those restrictions here. It is recommended to use different subnets for your guest network and your own network to simplify these restrictions.