Second step and passkeys
An admin user signs in with a password and, after it, a code from an authenticator app; or with a passkey, which proves the device and its owner at once and so needs no second step. The server can demand the second step of every admin user who uses a password.
The admin app's sign-in page offers three methods behind one control: Password, Passkey and Server Token. The third is the break-glass, see Break-glass on the host. The form is throttled: five attempts a minute per username and address. An unknown username, a wrong password and an admin user who has no password all get the same answer, in the same time, so the page doesn't say which usernames exist.
The Password & Security page
Each admin user manages their own sign-in on Password & Security, reached from their username in the top bar. It is the admin app's copy of the account panel's page, and the account docs describe the mechanics that are the same: Password & Security (confirming your identity, the password, passkeys, going passwordless), Second steps (the authenticator app, backup codes and their yearly check, trusted devices, a passkey or a device in place of the code) and Devices. What follows is what differs for an admin user.
| Section | Holds |
|---|---|
| How You Sign In | Passkeys, Password, and Server Token. The last is always there and has nothing to manage: root on the host can sign any admin user in. |
| Recent Activity | Your sign-ins and security changes of the last 30 days; Your Activity lists them all. See Auth Log. |
| Second Steps | Authenticator App, Push Verification, Backup Codes, Trusted Devices, and two rows that say why a passkey and a server token aren't asked for one. Only while you have a password. |
| Improving Security | Go Passwordless, Enable Two-Step Verification, Push Notifications: what is open to you now. |
| Other Options | Set a Password on an admin user that has none; an authenticator app that is kept but Not used because you have no password. |
| Admin Sign-In Rules | The server-wide rule; see A second step for every admin user. Not about you: about every admin user. |
A session that signed in with a server token sees a note at the top saying that no second step was asked, and why.
Confirm your identity
Before an action that changes how somebody gets into the admin app, the page asks you to confirm your identity: a password change, a new passkey, the authenticator app, the backup codes, a device, going passwordless, and every change on Admin Users. You confirm with your password, a passkey, or a server token from the host; the confirmation holds for five minutes. Going passwordless accepts a passkey only, which also shows that the passkey works on the device you're using.
Password
Change Password asks for the new password only, after you confirm your identity; so an admin user who forgot their password but has a passkey signs in with the passkey and sets a new one here. A password that is on a public list of leaked passwords gets a Leaked badge, here and on Admin Users.
A change ends your other sessions. The command-line equivalent is
server:admin-user:set-password, which also gives a password back to an
admin user who has none:
elpanctl server:admin-user:set-password <username>
Passkeys
Manage Passkeys, Add Passkey and the certified security key work as in the account panel; see Password & Security in the account docs. The Last used address of a passkey is forgotten after 180 days; the time stays. See Auth Log.
A second passkey, e.g. a hardware key kept in a safe place, is the cheapest way to never need the break-glass on the host.
The authenticator app
The app, its ten backup codes and their yearly check, the trusted devices and a passkey or a device in place of the code are the account panel's; see Second steps. One thing differs: while the server demands a second step of every admin user, the app can be replaced with Set Up Again but not turned off.
Devices
Devices registers the phones and computers that get sign-in alerts and approve sign-ins by Web Push, as in the account panel; see Devices. Alerts carry more here. Admin users have no email address in the panel, so a device with alerts on is how you hear that an admin user was created, reset or deleted. The notifications are in English.
Go passwordless
Go Passwordless removes your password, leaving your passkeys as the
only way in. The page lists Your Passkeys, warns with No Backup
Passkey when your only passkey can't leave its device, says What
Changes, and answers What Happens If I Lose My Passkey?: root on the
host signs you in with server:login or gives you a password with
server:admin-user:set-password. The removal needs at least one passkey
and a passkey confirmation. Not Now stops the suggestion; the row stays
under Improving Security.
There is no way back to the old password. To use a password again, set a
new one under Other Options, or on the host with
server:admin-user:set-password.
A passwordless admin user has no Second Steps section and is not touched by the server-wide rule below. The authenticator app, if there was one, is kept but not used.
A second step for every admin user
By default, each admin user decides for themselves whether to set up an authenticator app. The server can make it a rule: every admin user who signs in with a password must use one.
elpanctl server:edit --admin-second-step=on
elpanctl server:edit --admin-second-step=off
elpanctl server:edit
server:edit without options shows the current state. The same rule is
the Second step for every admin user row of the Admin Sign-In
Rules card on Password & Security, with Turn On and Turn
Off. Turning it on asks for a confirmation; turning it off lowers the bar
for everybody, so it also asks you to confirm your identity.
While the rule is on:
- An admin user who signs in with a password and has no authenticator app is stopped after the password, on a page titled A Second Step Is Necessary. They set up the app there, see their backup codes once, and finish the sign-in with a code from the new app. Until then they can reach nothing else; the page offers only that and Sign out.
- An admin user who has the app can replace it but not turn it off. Their Second Steps badge reads Required.
- A setup link's Finish waits until an admin user who set a password has also set up the app.
- A passkey sign-in and a server token are not asked, and a passwordless admin user is unaffected: a passkey does both steps, and only root on the host can make a token.
The card sits on each admin user's own security page rather than on a settings page of its own because that is where its effect shows: the Required badge and the authenticator app that can't be turned off. An admin user who turns the rule on sees at once what it asks of them.