Cannot sign in to the panel

What you see

The sign-in page shows one of these messages:

• “Incorrect username or password. Check both and try again.”
• “This account is locked. Ask an administrator to unlock it.”
• “Too many failed attempts from this address. Try again in N minutes.”
• “This form expired before it was sent. Sign in again.”
• “Your session ended. Sign in again to pick up where you left off.”
• “Sign-in didn’t go through. Try again.”

After the password, the two-factor page can show “That code didn’t match. Check the digits — codes change every 30 seconds — or use a backup code.” or “That backup code didn’t match, or it was already used. Check it, or use your authenticator instead.”

Cause

Incorrect username or password

The pair is wrong. Check the username spelling and caps lock. An Owner can set a new password under Users.

This account is locked

An Owner locked the account, or the panel locked it after 10 failed sign-ins in a row. An Owner unlocks it under Users, or root unlocks it with hctl.

Too many failed attempts from this address

The panel allows 5 failed attempts per address in 15 minutes. After that it refuses sign-ins from the address and shows the minutes left. An address that keeps sending requests after that is banned at the firewall. See Bans.

The form expired, or the session ended

The page sat open too long. Sign in again. A session lasts 8 hours from sign-in by default (session_ttl_secs in web.toml).

The code does not match

Codes change every 30 seconds, so a phone with a wrong clock produces codes that never match. Use a backup code, or ask someone with root on the master to remove your two-factor enrollment.

Fix

If another Owner can sign in, they open Users and set a new password or unlock the account. See Add and manage panel users. Removing two-factor is done only on the server.

Otherwise use the server. These commands run as root on the master and do not need the panel. Regain access to the panel has the full procedure:

sudo hctl user unlock <username>
sudo hctl user reset-password <username>
sudo hctl user disable-2fa <username>

reset-password asks for the new password; --password-stdin reads it from a pipe. disable-2fa is for a lost phone with no backup codes left. The user signs in with the password alone and enrolls again from My profile. See the CLI reference.

When your address was banned, lift the ban from the server:

sudo hctl ban list
sudo hctl ban remove <ip>

Check that it is fixed

Sign in with the account. After disable-2fa, the two-factor page no longer appears for that user until they enroll again. After ban remove, sudo hctl ban list no longer lists the address.

Related

• Set up two-factor sign-in