The two-factor plugin guarding our admin panel is open source

Much of Rutba runs on Strapi, an open-source content backend. Its admin panel is where the most sensitive levers are: the content itself, the media library, API tokens, roles, and who holds which of them. Out of the box, the panel asks for a password and nothing else. Anybody holding an administrator’s password holds all of that.

So we built the second factor ourselves, put it in front of our own panel first, and published it: strapi-admin-2fa-pro, on npm, under the AGPL.

What it does

• A six-digit code after the password, on the admin panel’s own sign-in screen.
• Enrolment three ways: a QR code, a one-tap button that opens the authenticator app on a phone, and the setup key written out for typing by hand — the same three we use for Rutba’s own sign-in.
• Ten recovery codes, single use, shown once and stored hashed.
• A policy you set from the panel: optional for everyone, required for everyone, or required for particular roles, with a grace period.
• Enrolment at the door: an administrator who is required to have an authenticator and does not is shown the QR on the sign-in screen and signed in as soon as they confirm it, rather than sent to find a settings page.
• A coverage table showing which administrators are actually protected, and a button to end everyone else’s sessions so a new policy applies today rather than whenever those sessions happen to expire.
• Lockout per account, not per network address, after repeated wrong codes.

It covers the less obvious doors too. A sign-in through an external provider asks for the second factor like any other — it is a different route from the password sign-in, and guarding only one of them leaves a way round. And the same authenticator is available to a site’s own users, not only its administrators, with ready-made sign-in pages for anybody who would rather not build them.

Two authenticators, on purpose

Our own staff hold two entries in their authenticator app: one for their Rutba sign-in and one for the admin panel, named differently so they can be told apart at a glance. They never share a factor. The admin panel is a separate door with a separate blast radius, and a factor that opened both would make one stolen phone twice as valuable.

If someone has an administrator’s password, they have everything behind the panel. This puts a code in front of that.

Why give it away

For the same reason we gave away our office suite: the thing it protects is not the thing we sell. Every business running this backend faces the same gap, and a second factor is exactly the kind of software that gets safer when more people read it. Publishing it under the AGPL means that anybody who changes it and runs it for other people shares those changes too.