About the new enforcement of 2FA login on gateway

[TobiasAntiGravity]

Hi Guys

I have seen some mentions about this on other discussion threads, but thought it could be helpful for people if we made a thread.

I have been chatting with IBKR support multiple times now, trying to get the mandatory 2FA login down to once a week. So far I seem to be missing something. Posting the feedback recieved here, as well as what I have tried so far to help others, and hopefully get some input myself.

First off; my issue

I recieved a mail saying that 2FA would become mandatory for gateway connections starting the 5th of december, but that 2FA would only be required once a week. Since that cut off date however, I have had to 2FA every day.

From what I gather the gateway connection has to be renewed on a daily basis, but that you would only require 2FA login once a week - on sundays. You can choose a time for the reconnect to happen every day. I have experimented with different times (under the Lock and Exit section in gateway settings, with the "auto restart" alternative), but have not found any way to avoid having to 2FA every day.

Feedback from IBKR

under the Lock and Exit section in gateway settings, there are two alternatives - "auto restart" and "auto logoff".

I was adviced to use "auto restart", for a renewed login without 2FA. This seems to be in accordance with the documentation

Look up the maintenance schedule for your area and set the auto restart time to the end of the maintenance period. I am in Europe. Monday-Thursday maintenance time for Europe is 05:45-06:45. The advice from support was to set restart time to 06:45. Which for UK time, which I am keeping on my systems is 05:45.

Also build version should not matter. My setup is to get the latest version every time I do a new image build on docker. I gave my version number to support - they had no comment other than - version number should not matter.

My setup - which has not worked yet.

In my latest setup, I selected the "auto restart" option and set the time to 11:45 PM, as I saw Rob wrote was his setup. Looking at my logs it does not look like the gateway ever started up after the mentioned time.

Next variation to try.

I am going to try to set the restart time to 05:45 am as per advice from IBKR support. Problem here is that the stack handler and capital update (I have spread the processes on two different containers) is running at this point in time.

However the chance of any trading activity taking place at this time would be very small as I see it, given the market open / close times. It is long after the opening of Japan, so any trading here should have been done a long time ago. At the same time it is before Europe opens.

I suppose Stack handler could run into issues / crash if it is doing the spread collection at this point in time, but I do not think it will occur at this point in time, looking at old logs. Same probably for capital update. Might have to move the end of day routine such that it finishes right before 05:45, but that would not leave that many hours for the Japanese market.

As menionted any input is much appreciated!

[tgibson11]

Looking at my logs it does not look like the gateway ever started up after the mentioned time.

This is not clear to me. What logs? What are you seeing there.

Here is my understanding based on your post:

• It is not the weekend
• You have the Gateway running and are logged in sometime prior to 11:45pm.
• You have auto-restart set to 11:45pm
• Sometime after 11:45pm (the next morning?) you see the Gateway is not running?

I have the exact same setup, and it works just fine for me. The only time I have to do anything with the IB Gateway is Sunday evening. I start it up and login (I do this around 5pm). That's it. I don't touch it again for the rest of the week. I didn't even know it was "restarting" every night until I looked at the settings just now.

[tgibson11]

No, I'm in the US.

[TobiasAntiGravity]

ok - well than that is a siginificant difference - ref the IBKR support advice to set restart time to the end of the scheduled daily maintenance. But from what I gather Mr. Carver had the same setup and is not having any issues.

[tgibson11]

So, it's not that the Gateway fails to re-start, it's that it fails to login after restarting. Is that correct?

This is sort of a random thought, but to support this "auto-restart-without-having-to-login" feature, the Gateway would have to cache some kind of token representing your session/connection/credentials, whatever you want to call it.

You also mentioned you are using Docker (which I'm not familiar with)...but is it possible that the Gateway doesn't have write access to whatever location it's trying to save this "token"?

[tgibson11]

Following up on that thought:

If I look in my user's Jts folder, I see this:

todd@todd-desktop:~/Jts$ ls -ltr
total 296
-rw-rw-r--  1 todd todd   258 Oct  8  2021 messageurls.properties
drwxr-xr-x 10 todd todd  4096 Sep  2 17:41 ibgateway
drwxrwxr-x  3 todd todd  4096 Nov  6 18:05 aakjiidigleomjfhhdjljgfgalfpnbnoeafjbhlk
-rw-rw-r--  1 todd todd 75440 Dec  4 23:45 launcher.20221204.log
-rw-rw-r--  1 todd todd 24818 Dec  5 23:45 launcher.20221205.log
-rw-rw-r--  1 todd todd 25443 Dec  6 23:45 launcher.20221206.log
-rw-rw-r--  1 todd todd 24807 Dec  7 23:45 launcher.20221207.log
-rw-rw-r--  1 todd todd 25225 Dec  8 23:45 launcher.20221208.log
-rw-rw-r--  1 todd todd 50183 Dec 11 23:45 launcher.20221211.log
-rw-rw-r--  1 todd todd 24817 Dec 12 23:45 launcher.log
-rw-rw-r--  1 todd todd  4120 Dec 12 23:45 xmlopt.dat
-rw-rw-r--  1 todd todd   743 Dec 12 23:45 jts.ini

Note in particular the files with a 23:45 timestamp.

If I look in the latest launcher.log, I see the following:

2022-12-12 23:45:40.610 [FO] INFO  [JTS-MiscUlrsRequester-5] - Connecting ndc1.ibllc.com:4000 timeout=10000...
2022-12-12 23:45:40.614 [FO] INFO  [AWT-EventQueue-0] - Running in auto-restart mode: restoring session token and session ID [userDirname=***]...
2022-12-12 23:45:40.614 [FO] INFO  [AWT-EventQueue-0] - Reading data from '/home/todd/Jts/***/autorestart'...
2022-12-12 23:45:40.625 [FO] INFO  [AWT-EventQueue-0] - AutoRestartDescriptor[autoRestartType=DAILY,sessionId=***,sessionToken=XYZSessionToken[type=TST,token=***..],paperMode=false]
2022-12-12 23:45:40.625 [FO] INFO  [AWT-EventQueue-0] - Deleting '/home/todd/Jts/***/autorestart'...
2022-12-12 23:45:40.626 [FO] INFO  [AWT-EventQueue-0] - UserCredentials.sessionId() [this=***,old=null,new=***].
2022-12-12 23:45:40.834 [FO] INFO  [JTS-MiscUlrsRequester-5] - Connected to ndc1.ibllc.com:4000 on local port 0 socket local addrs:port /192.168.1.179:36342

That is where it is doing the re-login using the cached data from the previous connection. (I've replaced possibly-sensitive stuff w/ ***).

So I'd suggest you look there, and compare what you have.

[TobiasAntiGravity]

Damn. Thank you so much Todd!!!!! Really appreciate it! I will look into this

[emretezel]

Despite having logged into User Settings and opted out of 2FA, for the first time this morning when IBC launched IB Gateway, the application launched 2FA screen.

Are you guys getting this well?

PS: I am running IB Gateway 2019, with daily auto-logoff at 23:50 GMT and daily start at 00:05 GMT.

Best,

[emretezel]

It seems there is now no way to avoid 2FA, so the best course of action would be to restart IB Gateway over the weekend and keep it live for a week. You just have to be around with your phone to pass 2FA during weekend restart.

Do you guys see it that way as well?

I guess one should also update to latest IBC.

[TobiasAntiGravity]

Hi emretezel.

I can confirm that I got an email saying that 2FA would be mandatory for the gateway starting the 5th of december. The opt out function would no longer work. That is why I opened this thread.