Sophos UTM9 - MFA Loop

Hello phi IT-Services GmbH ,

Thank you for reaching out to the community, may we know which authenticator app you are using for scanning  the QR code ? 

Hi Kevin,

Good day and thanks for reaching out to Sophos community and hope you are well.

Few Queries:

-Kindly verify if you have followed all steps as per this kb: https://docs.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/AuthServicesOneTimePassword.htm

-Also if possible can you show result of aua.log while encountering the issue? under Shell run tail -f /var/log aua.log

-And may we verify what authenticator app you are using?

Kindly let us know. Many thanks have a nice day ahead and thank you for choosing Sophos

Cheers,

Hello Vivek Jagad, hello Raphael Alganes,

thank you for the message. I use the Google Auth app. Here is the excerpt from the aua.log:

2023:01:17-14:32:13 remote aua[3775]: id="3006" severity="info" sys="System" sub="auth" name="Running _cleanup_up_children with max_run_time: 20"
2023:01:17-14:32:13 remote aua[3302]: id="3006" severity="info" sys="System" sub="auth" name="OTP verification did not succeed, failing authentication."
2023:01:17-14:32:13 remote aua[3302]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="192.168.0.10" host="" user="testuser" caller="portal" reason="DENIED"
2023:01:17-14:32:47 remote aua[3775]: id="3006" severity="info" sys="System" sub="auth" name="Running _cleanup_up_children with max_run_time: 20"
2023:01:17-14:32:47 remote aua[3375]: id="3006" severity="info" sys="System" sub="auth" name="OTP verification did not succeed, failing authentication."
2023:01:17-14:32:47 remote aua[3375]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="192.168.0.10" host="" user="testuser" caller="portal" reason="DENIED"

Kind regards

Kevin

Hello,

Good day and Thanks for sharing these details.

please check SHA settings on under OTP if it is 265 or 512 and if Google Authenticator support such hash algorithm or falling back to SHA1, then try to change in UTM by changing SHA settings to match authenticator hash algorithm. 

alike community thread reference that you can also refer to:

-  Sophos SG UTM: OTP QR Code doesn't work 

- RE: Users cannot login with OTP 

Hope this helps. Kindly let us know how it goes. Thanks for your time and patience and thank you for choosing Sophos.

Hello Raphael Alganes,

thank you for the message. I switched the hash SHA1 and now it works. :) many thanks for the help.

Best regards

Kevin