Description

Ensure two-factor authentication (2FA) is enabled on the OVHcloud account, using at least one method such as a mobile authenticator app, a security key, or SMS. With 2FA enabled, signing in to the Control Panel requires a one-time code or key in addition to the password.

Rationale

The OVHcloud account controls every service, invoice, and resource it owns, so a stolen password alone could give an attacker full control. Two-factor authentication blocks sign-in with only a password, which protects the account against phishing, password reuse, and leaked credentials.

Impact

  • Signing in requires a second factor in addition to the password

  • Protects all services in the account from password theft

  • Users must keep their 2FA device and backup codes safe

Default Value

By default, two-factor authentication is not enabled on an OVHcloud account.

Pre-Requisites

  • Access to the OVHcloud account owner login

  • A mobile authenticator app, a security key, or a phone number for SMS

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).

  3. Check the Two-factor authentication section and verify that at least one method is enabled.

  4. If no method is enabled, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).

  3. On the Account security page, click Enable two-factor authentication.

  4. Choose a method (Mobile App, Security Key, or SMS) and follow the steps to link your device.

  5. Save the 10 single-use backup codes shown on screen in a secure place, such as a password manager.

  6. Optionally add a second method so you can still sign in if one device is lost.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).

  3. Delete the enabled two-factor devices, and disable the backup codes, entering a backup code to confirm. Two-factor authentication is fully disabled only when all devices and backup codes are removed.

Reference