# noust 2fa

Enrol, confirm, disable or recover two-factor authentication for logins.

```bash
noust 2fa [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`backup-codes`](#noust-2fa-backup-codes), [`confirm`](#noust-2fa-confirm), [`disable`](#noust-2fa-disable), [`enroll`](#noust-2fa-enroll), [`status`](#noust-2fa-status)

## noust 2fa backup-codes

Regenerate the backup codes, invalidating every one issued before.

```bash
noust 2fa backup-codes [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust 2fa confirm

Verify CODE against the pending secret and activate the second factor.

```bash
noust 2fa confirm [OPTIONS] CODE
```

Arguments: `code`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust 2fa disable

Turn the second factor off, on presentation of a current CODE or an unused backup code.

```bash
noust 2fa disable [OPTIONS] CODE
```

Arguments: `code`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust 2fa enroll

Begin enrolment: generate a pending secret. Nothing is enforced until 'noust 2fa confirm CODE' verifies it.

```bash
noust 2fa enroll [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust 2fa status

Report the two-factor state, without exposing any secret.

```bash
noust 2fa status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |