Two-factor authentication requires the end-user to provide a token after initially logging into Nagios XI. We will receive the token as a email and if we don’t use it, it will expire after a set amount of time.
Two factor authentication sends an email to the address associated with a user account.
If a user is not receiving the emails then the first step is to confirm their email address is correct via Admin > Users > Manage Users.
You need to be an administrative user to be able to manage users, if you are unable to login as an administrative user.
In this context, we shall look into methods to resolve issues with two-factor authentication.
Here, we you will learn how to make things work.
Initially, login as an administrative account and navigate to Admin > System Config > System Settings.
On the Security tab, we will find the two-factor authentication settings:
i. Enable Two Factor Auth: We need to check this box to enable the functionality
ii. TwoFactor Token Timeout: This setting defines how long the token will remain active before it expires.
iii. Two Factor Cookie: It allows the end-user to store a cookie on their computer that will not prompt them for the two-factor token when they log in.
iv. Two Factor Cookie Timeout: This setting defines how long the cookie remains valid before it expires.
After making these selections, we click the Update Settings button.
Once done, we will see the below prompt after logging into Nagios XI
Here, the "Remember this browser" checkbox will only appear if the "Two Factor Cookie" setting is enabled.
If we do not receive the emails, then the first step is to confirm the email address is correct via Admin > Users > Manage Users.
If the only administrative account we have is the nagiosadmin account, it can lock us out of Nagios XI.
If we configure the nagiosadmin account with the default root@localhost email address, this can happen.
However, we can retrieve the token by looking at the /var/spool/mail/root mailbox on the Nagios XI server:
grep -A2 ‘token below’ /var/spool/mail/root
To continue logging in, please enter the token below:
To continue logging in, please enter the token below:<br />
The output shows the token is 16616.
We can use this to log in to the Nagios XI system as the nagiosadmin account.
Then, we can change the nagiosadmin account to the correct email address.
If we fail to retrieve the token from the /var/spool/mail/root mailbox, then it is likely that the nagiosadmin account has an email address we are unaware of.
In this scenario, we have to reset the nagiosadmin account which also disables two-factor authentication.
To reset nagiosadmin password, we open an SSH or direct console session to Nagios XI host and run:
If we want to add special characters in the password, we should escape them with "\".
For example, suppose, we want it to be "$new password#":
/usr/local/nagiosxi/scripts/reset_nagiosadmin_password.php –password=\$new\ password\#