Two-factor sign-in and panel security
Adding an authenticator to your own account, keeping the recovery codes somewhere you will still have them, and the sign-in policy that applies to everybody: password rules, lockouts, session length, and requiring a second factor of your administrators.
Your own account
Profile, then Sign-in and security.
You enrol your own account and nobody else’s. There is no screen anywhere that turns on a second factor for another person, and that is the point: a factor somebody else set up is not a second factor, it is a second thing that person has.
Enrolment is two steps. Dashmox shows a QR code and stores the secret unconfirmed, then asks for a code computed from it. Only when that code is right does the factor become live. Without the second step an account could end up locked behind a secret that never made it into an authenticator, which is a lockout the panel itself would have caused.
Your password is asked for both when you turn it on and when you turn it off. Somebody who walks up to an unlocked browser should not be able to remove your second factor, or add one that locks you out of your own panel.
Recovery codes
Ten codes, each good once, and the time to save them is now.
Enrolling gives you ten recovery codes. Each works once, in place of an authenticator code, and that is the whole of your way back in if the phone is lost, wiped or replaced. The panel tells you when three or fewer are left, because the useful moment to notice is before the last one.
Put them where you will have them when you do not have your phone. A password manager on another device, or printed and somewhere physical. A note on the phone that holds the authenticator is not a backup of anything.
Two-factor on since 14 October 2026 Recovery codes 7 of 10 remaining Authenticator any TOTP app: 6 digits, 30 second interval
If you lose the phone and the codes
The server itself is the last way in.
If the authenticator is gone and the recovery codes are gone, the panel cannot help you: that is what a second factor means. What remains is a shell on the server, where the command line tool can clear the factor from your account. So the real prerequisite for turning this on is being sure you can still reach the machine, which is SSH access.
This is the one thing to settle before you enrol, not after. Everybody who gets locked out discovers the order of those two steps the hard way.
The policy for everybody
Server settings, Security, Signing in.
One policy applies to every account on the panel. It is the operator’s to set, and a stored policy that is somehow incoherent is not enforced: the default is, because failing open would be the worse mistake.
| Setting | What it means | Default |
|---|---|---|
| Minimum length | How short a password may be. Twelve is the floor and cannot be lowered. | 12 |
| Require upper, lower, digit, symbol | Four switches. Each adds a class of character a password must contain. | All off |
| Refuse common passwords | Rejects the passwords that appear in every breach list. Worth more than any of the four switches above. | On |
| Refuse passwords containing identity | Rejects a password built from the account’s own name or address. | On |
| Lockout attempts | Wrong passwords on one account before it is locked. | 10 |
| Lockout minutes | How long that lock lasts. | 15 |
| Block attempts | Failures from one address before the address itself is blocked. | 10 |
| Block hours | How long that block lasts. | 24 |
| Session hours | How long a sign-in lasts before the password is asked for again. One to 720. | 12 |
| Idle minutes | How long a session may sit untouched before it ends. Zero means no idle limit. | 0 |
| Require two-factor of administrators | Owners and administrators must enrol before they can use the management pages. | Off |
Choosing the numbers
Length and the two refusals do most of the work.
A twelve character password that is not in a breach list and does not contain your own name is strong. Requiring a symbol mostly produces the same password with an exclamation mark at the end, which is why those four switches are off by default and the two refusals are on.
The lockout and the block are different tools. The lockout protects one account from somebody guessing at it; the block protects the server from an address working through many accounts. Leaving both at ten and raising the durations is more useful than lowering the counts, because a person who mistyped simply waits.
Idle minutes at zero is not an oversight. A session that ends while you are reading a log and comes back as a sign-in form is how people learn to keep the panel open in a tab forever. Set it if the panel is used from machines other people can reach, and leave it at zero if it is not.
Requiring it
Turn on the administrator requirement after you have enrolled, not before.
The requirement applies to owners and administrators and holds them out of the management pages until they have a factor. Enrol your own account first, confirm it, save the codes, and then turn the requirement on. In that order it is a policy; in the other order it is a locked door with you on the outside.
Who may reach the panel at all is a firewall question rather than a sign-in one, and lives under The server firewall. Roles and what each account can reach once it is in are Panel users and roles.