Accounts, 2FA and App Passwords
Accounts, 2FA and App Passwords
Adapted from GitLab's identity and access guidance, for NFE's Nextcloud + LDAP setup.
How NFE accounts work
| System | How you log in | Notes |
|---|---|---|
| Nextcloud (files, Talk, Deck, Mail app, Calendar) | NFE username + LDAP password | Supports 2FA (TOTP) and app passwords |
| Mail: IMAP/SMTP (phone and desktop mail apps) | full email address + LDAP password | No 2FA. A stolen password can send mail directly. |
| Roundcube webmail (webmail.nearlyfreeenergy.com) | email + LDAP password | Public login page, no 2FA today |
| BookStack (this Library) | own login | |
| ERPNext, Plane, others | own logins | Turn on 2FA wherever offered |
Because mail and webmail accept the bare LDAP password, 2FA in Nextcloud alone does not stop someone with your password from sending mail as you. That is exactly what happened in 2026.
What every team member does
- Turn on 2FA in Nextcloud: Personal settings → Security → Two-Factor Authentication → TOTP. Use an authenticator app and save the backup codes in your password manager. Required for everyone in the
adminsgroup. - Use Nextcloud Mail or Roundcube in the browser instead of saving your LDAP password in phone or desktop mail apps where possible.
- One app password per device or tool:
- Create it in Nextcloud → Personal settings → Security → Devices & sessions → Create new app password.
- Name it after the device or tool (
aaron-phone-mail,claude-api,dansturn-laptop-sync). - Revoke it when the device is lost, replaced or no longer used.
- Review Devices & sessions monthly. Revoke anything you don't recognise and report it.
- Admins: use your admin rights only when you need them. The Security DRI reviews
adminsmembership every quarter.
Planned improvements (Security DRI + Federated Computer)
- 2FA for Roundcube (e.g.
twofactor_gauthenticator), or retire Roundcube in favour of Nextcloud Mail. - Per-user outbound mail rate limits and alerts on unusual sending volume.
- Rate-limiting and blocking of repeated failed logins (fail2ban) on SMTP/IMAP/Roundcube.
- Investigate app-password-only access for IMAP/SMTP, so the main password never sits in a mail app.