Unable To Login Using Two Factor Authentication in Nagios? We can help you.
Two-factor authentication requires the end-user to provide a token after initially logging into Nagios XI. We will receive the token as a email and if we don’t use it, it will expire after a set amount of time.
As part of our Server Management Services, we assist our customers with several Nagios queries.
Today, let us see how to resolve issues with two-factor authentication.
Unable To Login Using Two Factor Authentication in Nagios
Moving ahead, let us discuss things we need to do to make it work.
Enable Two Factor Authentication
Initially, login as an administrative account and navigate to Admin > System Config > System Settings. On the Security tab, we will find the two-factor authentication settings.
- Enable Two Factor Auth: We need to check this box to enable the functionality
- TwoFactor Token Timeout: This setting defines how long the token will remain active before it expires.
- Two Factor Cookie: It allows the end-user to store a cookie on their computer that will not prompt them for the two-factor token when they log in.
- Two Factor Cookie Timeout: This setting defines how long the cookie remains valid before it expires.
After making these selections, we click the Update Settings button.
Once done, we will see the below prompt after logging into Nagios XI:
Here, the “Remember this browser” checkbox will only appear if the “Two Factor Cookie” setting is enabled.
Confirm Correct Email Address
If we do not receive the emails, then the first step is to confirm the email address is correct via Admin > Users > Manage Users.
Cannot Login As nagiosadmin
If the only administrative account we have is the nagiosadmin account, it can lock us out of Nagios XI.
If we configure the nagiosadmin account with the default root@localhost email address, this can happen.
However, we can retrieve the token by looking at the /var/spool/mail/root mailbox on the Nagios XI server:
grep -A2 ‘token below’ /var/spool/mail/root
To continue logging in, please enter the token below: 16616 — To continue logging in, please enter the token below:<br /> <br /> 16616<br />
The output shows the token is 16616. We can use this to log in to the Nagios XI system as the nagiosadmin account. Then, we can change the nagiosadmin account to the correct email address.
If we fail to retrieve the token from the /var/spool/mail/root mailbox, then it is likely that the nagiosadmin account has an email address we are unaware of. In this scenario, we have to reset the nagiosadmin account which also disables two-factor authentication.
To reset nagiosadmin password, we open an SSH or direct console session to Nagios XI host and run:
If we want to add special characters in the password, we should escape them with “\”.
For example, suppose, we want it to be “$new password#”:
/usr/local/nagiosxi/scripts/reset_nagiosadmin_password.php –password=\$new\ password\#
[Need help with the solution? We can help you]
To conclude, today, we saw how our Support Techs resolve Two Factor Authentication error in Nagios.