multiOTP Self-Hosted MFA Server - TOTP/HOTP

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Self-Hosted Two-Factor Authentication - Deploy in Minutes, Not Hours

multiOTP is an open source, OATH-certified strong-authentication (MFA) server that adds time-based (TOTP) and event-based (HOTP) one-time passwords to your applications, VPNs, and network devices - while keeping every token seed on infrastructure you control. This AMI delivers multiOTP 5.10.2.2 (LGPL open-source edition) fully installed and hardened. Launch the instance and sign in to the web admin console over HTTPS to start creating users and provisioning tokens immediately.

## Why This AMI Instead of a Manual Install

Standing multiOTP up from source means installing and tuning a PHP runtime, wiring a web server, generating a TLS certificate, hardening the admin gate, and validating the OATH engine end to end - hours of work with plenty of room for misconfiguration that undermines the very system meant to protect you. This image removes that entire workflow:

• Zero configuration required - PHP 8.3 with OPcache, nginx over HTTPS, and the flat-file token store are pre-tuned and connected
• No separate database server - the flat-file store keeps the appliance fully self-contained, reducing operational overhead and attack surface
• No shared or default credentials - every instance generates its own unique admin password and regenerates its TLS certificate on first boot
• Dedicated data volume - application code and user/token store reside on an independently resizable Amazon EBS volume

## Application Stack

• multiOTP 5.10.2.2 open-source (LGPL-3.0), OATH-certified TOTP/HOTP/Mobile-OTP
• PHP 8.3 with OPcache and all required extensions
• nginx serving the web admin over HTTPS on port 443, HTTP Basic auth in front of the console
• Flat-file user, token, device, and group store on a dedicated EBS data volume

## Secure First Boot

On first launch, a one-shot service generates a fresh administrator password unique to that instance, applies it in lock-step to both the nginx Basic-auth gate and the multiOTP web admin, regenerates a per-instance self-signed TLS certificate, and writes the credentials to a root-only file. Any build-time account and the multiOTP default admin are reset to unusable placeholders, so every instance starts with a clean, unique security posture.

## What You Can Protect

multiOTP speaks the standards your infrastructure already understands:

• OATH TOTP and HOTP - works with Google Authenticator, Microsoft Authenticator, FreeOTP, and any RFC 6238/4226 authenticator app
• QR-code provisioning - enroll a user's phone by scanning a QR code from the web admin
• RADIUS-ready - back a RADIUS front end to add MFA to VPNs, firewalls, and network gear
• CLI and web management - manage users and tokens from the browser console or the multiotp command line

On the AWS side, the dedicated data volume leverages Amazon EBS for durable, resizable storage. Enable EBS encryption for data-at-rest protection and use Amazon CloudWatch to monitor instance health and performance metrics.

## Use Cases

• Add MFA to a VPN or firewall - front a RADIUS-capable VPN, firewall, or network appliance with multiOTP so remote access requires a one-time code, without paying per-user for a hosted MFA service
• Two-factor for your own applications - issue TOTP/HOTP tokens and validate one-time passwords from your applications over multiOTP's CLI or web service, keeping every token seed inside your own VPC
• Privacy-focused, self-owned authentication - replace a hosted authenticator service with an open-standards server you control, avoiding vendor lock-in and keeping authentication secrets off third-party platforms

## Getting Started

1. Launch the AMI from AWS Marketplace

2. Retrieve the generated admin password from the root-only credentials file on the instance

3. Browse to the instance address over HTTPS and sign in to the multiOTP web admin console

4. Create a user and provision a token by scanning the QR code with an authenticator app

5. Point your applications, VPN, or RADIUS front end at multiOTP to begin validating one-time passwords

## cloudimg Support

24/7 technical support by email and live chat. Engineers assist with multiOTP deployment, upgrades, token and user provisioning, RADIUS integration, HTTPS/certificate setup, and EBS storage administration. Critical issues receive a one-hour average response time. Contact our support team for sizing guidance tailored to your environment.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.