Deploy

Locked out

Forgot your password, or lost your phone and your recovery codes? There are two ways back in.

Someone else can let you in

Anyone with the Manage users privilege can, from Settings → Users:

• Reset password: makes a new one-time link for you and signs you out everywhere. Your two-factor stays, and is asked for.
• Reset two-factor: for a lost phone. You set it up again at your next sign-in.

Nobody else can: reset it on the server

If you're the only one who manages users, run this on the server as root. Being root on the server is the proof that it's yours.

cd /opt/cermm
sh deploy/reset-password.sh            # the first person who may manage users
sh deploy/reset-password.sh USERNAME   # that person

It clears that person's password and two-factor sign-in, unsuspends them, signs them out and prints a link, good for 24 hours, to choose a new password. Devices, docs, history and everyone else stay as they were. It's written in the audit log as done by root.

The link uses CERMM_URL from /etc/default/cermm if it's set, otherwise the machine's first address and port 4800.

Too many tries

Ten wrong passwords or codes from one address means a 15-minute wait. Waiting it out is the only way; nothing needs resetting.