Two-Factor Authentication

This page explains the Two-Factor Authentication (2FA) feature in GoAdmio. It adds a second verification step to panel logins, protecting accounts even if the password is stolen.

Location: Admin Panel → Security → Two-Factor Authentication
Location (User Panel): Security → Two-Factor Authentication

Overview

Two-Factor Authentication (2FA) requires two pieces of evidence to log in:

1. Something you know — your password
2. Something you have — a time-based one-time code from an authenticator app

2FA applies to:

• Every domain account on the server — each account owner can enable 2FA for their own panel login
• The admin panel — the administrator can enable 2FA for their own login
• Any user who can log in to a panel — hosting account owners, resellers, and admins

How It Works

When 2FA is enabled for an account:

1. The user logs in with their username and password as usual.
2. GoAdmio prompts for a 6-digit code.
3. The user opens their authenticator app and reads the current code.
4. The user enters the code.
5. If the code is valid, the login completes.

> Tip: TOTP is resilient to phishing because the code is only valid for a short window — but it is not immune. A real-time phishing proxy can relay the code. Encourage users to verify the login URL before entering credentials.

What the Page Shows

| Field / Element | Description |
|---|---|
| QR Code | A scannable QR code that adds the account to the authenticator app |
| Secret Key | A text version of the secret, for manual entry if the QR code cannot be scanned |
| Code | A 6-digit field where the user enters the current code to confirm setup |
| Enable / Disable | Toggles 2FA for the account |
| Recovery Codes | One-time backup codes (if your version provides them) |

> Tip: The Secret Key is shown only during setup. Store it securely — it is the shared secret between the server and the authenticator app.

How to Enable 2FA

Step 1 — Open the 2FA page

1. Log in to the GoAdmio Admin Panel (or User Panel).
2. Navigate to Security → Two-Factor Authentication.

Step 2 — Scan the QR code

1. Install an authenticator app on your phone:

1. Open the app and choose Add account (or Scan QR code).
2. Scan the QR code shown on the GoAdmio page.

Step 3 — Confirm with a code

1. The authenticator app now shows a 6-digit code for the GoAdmio account.
2. Enter that code in the Code field on the page.
3. Click Enable (or Verify).

> Warning: If you lose access to your authenticator app and do not have recovery codes, you will be locked out of the panel. Save the recovery codes (if provided) or the secret key in a secure location before confirming.

How to Disable 2FA

1. Open Security → Two-Factor Authentication.
2. Enter your current password (and a valid code, if prompted).
3. Click Disable.

> Warning: Disabling 2FA reduces account security. Only disable it if you have lost access to your authenticator and have no recovery codes, or if you are migrating to a new device.

Recovery

If you lose access to your authenticator:

| Situation | Solution |
|---|---|
| You have recovery codes | Use a recovery code at the login prompt |
| You have the secret key | Re-add the account to a new authenticator app using the secret key |
| You have neither | An administrator must disable 2FA for the account — see below |

Administrator recovery

If a hosting account owner loses 2FA access and has no recovery codes, the server administrator can reset it:

1. Log in to the GoAdmio Admin Panel as root.
2. Navigate to the account's settings — either Modify Account or a dedicated 2FA reset action, depending on your version.
3. Disable 2FA for that account.
4. Notify the account owner to re-enable 2FA with a new device.

Recovery Codes

If your GoAdmio version provides recovery codes:

• They are generated once when 2FA is enabled
• Each code can be used once in place of a TOTP code
• Store them in a password manager or printed in a secure location
• Regenerate them if you suspect they have been exposed

2FA for Domain Accounts

Each domain account on the server has its own 2FA setting:

• Enabling 2FA for one account does not enable it for others
• Each account owner enables 2FA for their own panel login
• The server administrator can enforce 2FA for all accounts (if the version supports it) or encourage users to enable it

Verifying 2FA

Test the login

1. Log out of the panel.
2. Log in with your username and password.
3. Confirm the panel prompts for a 6-digit code.
4. Enter the current code from your authenticator.
5. Confirm you are logged in.

Test an invalid code

1. Log out.
2. Log in again.
3. Enter a wrong code.
4. Confirm the login is rejected.

Related Commands

| Command | Purpose |
|---|---|
| /go/help | Detect and resolve server problems |
| /go/iptop | Identify IPs attempting logins |
| /go/blacklist | Block IPs brute-forcing the panel |

> Note: 2FA is managed primarily through the panel. CLI commands for 2FA reset vary by version — see Command Reference.

Related Pages

• Change Admin Password — change the panel password
• Change Root Password — change the Linux root password
• Password Modification — change account passwords
• IP Blocker — block IPs attempting brute force
• Manage Shell Access — restrict SSH access
• Admin Login Alerts — alerts on panel logins
• Notification Settings — configure security alerts
• Basic GoAdmio Setup — administrator contact details for recovery

Troubleshooting

| Problem | Likely cause | Solution |
|---|---|---|
| QR code will not scan | Screen glare, low resolution, or app issue | Use the Secret Key to add the account manually |
| Code is rejected | Clock drift on the phone or server | Ensure the phone's time is automatic; verify the server's time with Server Time |
| Locked out after losing the phone | No recovery codes, no secret key | Administrator must reset 2FA for the account |
| 2FA prompt does not appear | 2FA not saved, or a cached session | Re-enable 2FA; log out fully and back in |
| Wrong code accepted | TOTP implementation issue | Investigate immediately; disable 2FA until resolved |
| Code works but login still fails | Password issue, or account suspended | Reset the password; check account status |
| Recovery code does not work | Code already used, or expired | Use a different recovery code; if all are used, administrator reset |
| Multiple accounts need 2FA | Each account is independent | Enable 2FA on each account separately |
| Phone lost but recovery codes saved | — | Use a recovery code, then re-enable 2FA on a new device |
| Authenticator app shows the wrong account | Multiple accounts added with the same label | Rename entries in the app, or re-add with a distinct label |

Best Practices

| Practice | Why |
|---|---|
| Enable 2FA on every admin account | Panel access is the highest-value target |
| Save recovery codes | The only way back in if the phone is lost |
| Store the secret key securely | Allows re-adding the account to a new device |
| Use a reputable authenticator app | Google Authenticator, Microsoft Authenticator, Authy, 1Password |
| Keep the phone's clock automatic | TOTP codes depend on accurate time |
| Enforce 2FA for resellers and shell-access accounts | Highest-risk accounts |
| Test the login after enabling | Confirms 2FA is working |
| Do not share 2FA codes | Treat them like passwords |
| Disable 2FA only temporarily | Re-enable after device migration |
| Monitor login alerts | Detect unauthorized access attempts; see Notification Settings |