<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Details are also in the User Weekly here:</div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><a href="https://www.jlab.org/news/briefs/jlab-weekly-scientific-users-march-13-2024" id="LPlnk165180">https://www.jlab.org/news/briefs/jlab-weekly-scientific-users-march-13-2024</a><br>
<br>
----------------------------------------------------------------<br>
MFA IMPLEMENTATION FOR INTERNET-FACING SERVICES - MARCH 19<br>
<br>
To improve the lab’s cybersecurity posture, the CST Division will<br>
require multifactor authentication (MFA) for Virtual Desktop<br>
Infrastructure (VDI) and Secure Shell (SSH), login.jlab.org, beginning<br>
Tuesday, March 19. This includes both the Windows and Linux VDI<br>
environments. It has become increasingly clear that passwords alone<br>
are not sufficient protection for sensitive information, and experts<br>
recommend implementing MFA where available.<br>
<br>
- NOTE: If you already have a 2-factor token to login to ifarm<br>
nodes, then you can use the exact same process to connect to<br>
login.jlab.org.<br>
<a href="https://jlab.servicenowservices.com/scicomp/?id=kb_article_view&sysparm_article=KB0015066" id="OWA2f6c716c-4a23-1379-0d88-8d5e240b76fa" class="OWAAutoLink" data-auth="NotApplicable">
https://jlab.servicenowservices.com/scicomp/?id=kb_article_view&sysparm_article=KB0015066</a><br>
<br>
In addition to new MFA authentication requirements, CST will<br>
shut down non-anonymous file transfer protocol (FTP) access<br>
through ftp.jlab.org. If you currently use anonymous FTP for your<br>
work, please plan to move to OneDrive or SharePoint, as these options<br>
are more secure.<br>
<br>
• Windows VDI: The Windows VDI environment will require smartcard<br>
MFA. If you do not have a smartcard and require access to these<br>
systems, please email the Help Desk to have a smartcard<br>
created for you. You can set up an appointment to receive the<br>
smartcard, and remote staff and users can have the smartcard<br>
mailed to them.<br>
<br>
• Linux VDI: On Jan. 29, CST rolled out a new RHEL 9 environment<br>
for VDI that will replace RHEL 7. The RHEL 9 environment requires<br>
MFA, and RHEL 7 will require MFA beginning Tuesday, March 19.<br>
Linux VDI and SSH through login.jlab.org will require enrollment<br>
in our MobilePass system, which can use either token-based<br>
authentication OR authentication via an authenticator app (for<br>
example, Google or Microsoft). As RHEL 7 becomes end-of-life in<br>
June, we will be disabling RHEL 7 VDI during the June maintenance.<br>
<br>
For questions, contact the Help Desk <helpdesk@jlab.org>, x7155.<br>
<br>
</span></div>
</body>
</html>