Unable To Login Using Two Factor Authentication in Nagios? We can help you.

Two-factor authentication requires the end-user to provide a token after initially logging into Nagios XI. We will receive the token as a email and if we don’t use it, it will expire after a set amount of time.

As part of our Server Management Services, we assist our customers with several Nagios queries.

Today, let us see how to resolve issues with two-factor authentication.

Unable To Login Using Two Factor Authentication in Nagios

Moving ahead, let us discuss things we need to do to make it work.

Enable Two Factor Authentication

Initially, login as an administrative account and navigate to Admin > System Config > System Settings. On the Security tab, we will find the two-factor authentication settings.

• Enable Two Factor Auth: We need to check this box to enable the functionality
• TwoFactor Token Timeout: This setting defines how long the token will remain active before it expires.
• Two Factor Cookie: It allows the end-user to store a cookie on their computer that will not prompt them for the two-factor token when they log in.
• Two Factor Cookie Timeout: This setting defines how long the cookie remains valid before it expires.

After making these selections, we click the Update Settings button.

Once done, we will see the below prompt after logging into Nagios XI:

Here, the “Remember this browser” checkbox will only appear if the “Two Factor Cookie” setting is enabled.

Confirm Correct Email Address

If we do not receive the emails, then the first step is to confirm the email address is correct via Admin > Users > Manage Users.

Cannot Login As nagiosadmin

If the only administrative account we have is the nagiosadmin account, it can lock us out of Nagios XI.

If we configure the nagiosadmin account with the default root@localhost email address, this can happen.

However, we can retrieve the token by looking at the /var/spool/mail/root mailbox on the Nagios XI server:

grep -A2 ‘token below’ /var/spool/mail/root

To continue logging in, please enter the token below:

16616
—
To continue logging in, please enter the token below:<br />
<br />
16616<br />

The output shows the token is 16616. We can use this to log in to the Nagios XI system as the nagiosadmin account. Then, we can change the nagiosadmin account to the correct email address.

If we fail to retrieve the token from the /var/spool/mail/root mailbox, then it is likely that the nagiosadmin account has an email address we are unaware of. In this scenario, we have to reset the nagiosadmin account which also disables two-factor authentication.

To reset nagiosadmin password, we open an SSH or direct console session to Nagios XI host and run:

/usr/local/nagiosxi/scripts/reset_nagiosadmin_password.php –password=newpassword

If we want to add special characters in the password, we should escape them with “\”.

For example, suppose, we want it to be “$new password#”:

/usr/local/nagiosxi/scripts/reset_nagiosadmin_password.php –password=\$new\ password\#

[Need help with the solution? We can help you]

Conclusion

To conclude, today, we saw how our Support Techs resolve Two Factor Authentication error in Nagios.