Back to Checks
linode

Linode account user has two-factor authentication enabled

administration_user_2fa_enabled
Service: administrationSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Linode account users are assessed for two-factor authentication (2FA) enablement. 2FA adds a second verification factor (a TOTP code or security key) on top of the password, so a stolen or guessed password alone is not enough to sign in to the Linode Cloud Manager.

Prowler logoProwlerprowler-provider-linode

Risk

Without 2FA, a single compromised password — through phishing, credential stuffing, or brute force — grants an attacker full access to the user's Linode account. This can lead to data exfiltration, destruction of instances and backups, and resource abuse for cryptomining, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler linode --checks administration_user_2fa_enabled

Recommendation

Enable 2FA for all Linode account users. Use an authenticator app (TOTP) for the second factor and store backup codes securely.

Remediation

Other

1Log in to the Linode Cloud Manager
2Navigate to My Profile > Login & Authentication
3Under Security Settings, configure all 3 security questions
4Enable Two-Factor Authentication

Check Code

from prowler.lib.check.models import Check, CheckReportLinode
from prowler.providers.linode.services.administration.administration_client import (
    administration_client,
)


class administration_user_2fa_enabled(Check):
    """Check if Linode account users have two-factor authentication enabled."""

    def execute(self) -> list[CheckReportLinode]:
        """Execute the administration_user_2fa_enabled check.

        Iterates over all account users and checks whether two-factor
        authentication is enabled.

        Returns:
            list[CheckReportLinode]: A list of findings for each user.
        """
        findings = []

        for user in administration_client.users:
            report = CheckReportLinode(
                metadata=self.metadata(),
                resource=user,
                resource_name=user.username,
                resource_id=user.username,
                region="global",
            )

            if user.tfa_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"User '{user.username}' has two-factor authentication enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"User '{user.username}' does not have two-factor authentication enabled."

            findings.append(report)

        return findings

References