Tools

Serv-U MFT Server MFA intermittently fails for users authenticating with Duo Mobile rotating TOTP codes

This article describes an issue where Serv-U MFT Server MFA intermittently fails for users authenticating with Duo Mobile rotating TOTP codes, while users on Microsoft Authenticator or Google Authenticator are not affected.

First published date

3/31/2026 12:21 AM

Last published date

3/31/2026 12:21 AM

Overview

When MFA is enabled for the Serv-U web client, some users who use Duo Mobile for TOTP codes experience intermittent MFA failures:

  • Users enter the 6‑digit Duo code shown on their device
  • Serv-U rejects the code as invalid, even though it appears correct to the user.
  • The same Serv-U instance works reliably for other users using Microsoft or Google Authenticator, with no MFA failures reported.

Product section

Serv-U Managed File Transfer & Serv-U FTP Server

Cause

Serv-U uses standard TOTP-based MFA for web logins:

  • Generates 6‑digit one-time codes
  • Each code is valid for 30 seconds only
  • TOTP algorithm: SHA‑1
  • The 30‑second validity window is fixed and cannot be configured in the current product; there is no UI/setting to extend this window

Serv-U does not differentiate between Duo, Microsoft Authenticator, or Google Authenticator:

  • All three apps generate TOTP codes according to the same standard.
  • Serv-U only validates:
    • The numeric TOTP value and
    • That it is within the allowed 30‑second time window.

Why Duo users see more failures

  • Duo Mobile emphasizes a “rotating” OTP UI, where:
    • Users often enter the code near the end of the 30‑second countdown, or
    • Just as the code rotates to a new value.

In these situations:

  • By the time the user submits the code, Serv-U may already consider that TOTP expired, resulting in an MFA failure.
  • Users of Microsoft or Google Authenticator, due to different UI/usage habits, are more likely to enter the code earlier in the 30‑second window, so they do not typically see failures.

Therefore, this is best classified as a product behavior/limitation of the fixed 30‑second TOTP window, made more visible by Duo’s rotating-code UX, rather than a Serv-U defect.

Resolution

1. Timing discipline when entering Duo codes.

Advise affected users to adjust how they enter Duo codes:

  1. Enter the code immediately after a new code appears in Duo Mobile, rather than waiting until the end of the countdown.
  2. If a code fails and the app is about to rotate:
    • Wait for the next full 30‑second cycle,
    • Then enter the new code promptly at the start of that window.

This maximizes the chance that Serv-U receives the TOTP while it is still within its valid 30‑second window.

 

2. Verify time synchronization (server and client)

Any time drift between the Serv-U server and the user’s mobile device effectively shortens the TOTP validity window and increases the chance of failures.

On the Serv-U server:

  • Ensure the OS system clock is accurately synchronized using a reliable NTP source.
  • Confirm that time zone, date, and time are correct and stable.

On user devices:

  • Ask users to set their mobile devices to automatically update date and time from the network or a trusted time source.
  • If possible, verify that the device time is not noticeably ahead/behind actual time.

Good time synchronization helps keep the full 30‑second window usable for MFA.

 

3. Optional: Standardize on Microsoft/Google Authenticator

If Duo users continue to experience issues despite the above:

  • Consider standardizing on Microsoft Authenticator or Google Authenticator for Serv-U MFA, as they have been reported to work reliably in our customers’ environment.

This is an operational workaround until Serv-U provides configurable MFA timing options.