Panel login & account security
The Reqad panel on port 2087 has its own login page with brute-force protection, two-factor authentication, passkeys, email codes for new devices and an optional firewall restriction - all managed under Settings › Security, with a command-line way back in if you ever lock yourself out.
reqad auth mode web - your current password keeps working.The login page
Open https://your-server:2087/ and sign in with the user name and password the installer printed (user reqad on a new install). Every request to the panel - pages, phpMyAdmin, the terminal and monitoring - needs a logged-in session.
- A session ends after 30 minutes without activity, and 12 hours after login whatever you do.
- The session cookie is bound to this panel only and cannot be read by scripts or sent from other sites.
- Log out is at the bottom of the menu.
To switch an updated server to the login page, or back to the browser's password prompt (the same password works for both):
reqad auth mode web # login page, 2FA, brute-force protection reqad auth mode basic # browser password prompt reqad auth status # which one is active, admins, blocked IPs
Brute-force protection
Failed logins are counted per IP address and escalate on their own:
| Failures from one address | What happens |
|---|---|
| 5 within 15 minutes | The address is locked out of the login form for 15 minutes. |
| 10 within an hour | The address is blocked in the firewall (CSF) for one hour. |
| A third firewall block within 7 days | The address is blocked permanently. |
The error message never says whether the user name or the password was wrong. Your own server's addresses, addresses in csf.allow / csf.ignore, the IP restriction list and any address with an active panel session are never blocked. Wrong 2FA codes, email codes and passkey attempts count as failures too.
Blocked addresses are listed under Settings › Security › Blocked addresses, with an Unblock button.
Confirming sensitive changes
Changes that could weaken the login - a new password, turning two-factor on or off, new recovery codes, turning passkeys on or adding one, changing the email address, turning login alerts off, adding an address to the IP restriction or turning it off, unblocking an address - ask "Confirm it's you" if your last confirmation is more than 10 minutes old. Enter your password (and 2FA code), or use a passkey. Logging in counts as a confirmation, so right after login nothing is asked.
Two-factor authentication
Turn on Two-factor under Settings › Security, scan the QR code with an authenticator app (Google Authenticator, Aegis, 1Password, Bitwarden and others) and enter the 6-digit code it shows. From then on the login asks for a code after the password.
- You get 10 recovery codes, shown once - copy or download them and keep them in your password manager. Each logs in once instead of an app code. New recovery codes replaces the whole set.
- Tick "Don't ask for a code on this device for 7 days" at login and that browser skips the code for a week. It still asks before sensitive changes.
- The app entry is named after the server's hostname, so several Reqad servers are easy to tell apart.
Lost your phone and your recovery codes? Turn 2FA off from the server and set it up again: reqad auth 2fa-reset.
Passkeys
A passkey logs you in with your fingerprint, face or device PIN - no password, no code. Your browser or password manager (Windows Hello, Touch ID, Android, iCloud Keychain, 1Password, Bitwarden, a security key) keeps the private key; the panel stores only the public half.
- Passkeys are off by default. Turn on the Passkeys switch, give the passkey a name and click Add a passkey.
- The login page then shows Log in with a passkey, and the confirmation dialog accepts one instead of your password.
- A passkey works only on the panel's hostname, so a look-alike site cannot use it. Passkeys are not available when the panel is opened by IP address.
- A passkey counts as a complete login - something you have, unlocked by something you are or know - so it does not ask for the 2FA code as well.
New devices and email codes
Every browser that logs in is remembered as a known device for 180 days. A browser the panel has not seen before - a new computer, a private window, cleared cookies - is a new device.
When two-factor authentication is off, a new device must also enter a 6-digit code sent to your email after the password. This is automatic - there is no switch - as long as the panel can send email (a sending method under Settings) and has an address to send to. The code is valid for 15 minutes; send a new code is on the same page. With 2FA on, the authenticator code already does this job and no email is sent.
- Send to is the address that gets the codes. A new address receives a code first and is used once you enter it, so a typo cannot lock you out; Send a test code checks the current one.
- If the code email cannot be sent at login (the mail server is down or misconfigured), the login goes through on the password and the Security log records it. Mail problems never lock you out.
- Login alerts - optional - emails you after each login from a new device, with its IP address and browser.
The Known devices list shows each browser with its last address and use. Forget makes it a new device again; changing your password forgets every device except the one you are using.
IP restriction
On servers with CSF, the IP restriction switch lets only the addresses you list reach the panel port at all - everyone else is dropped by the firewall before the login page.
- Turn on Restriction. Your current address is added automatically.
- A dialog asks you to open the panel in a private (incognito) window - it has a link to copy. If the login page opens there, click Keep the rules.
- Not confirmed within two minutes, the change is undone on its own, so a mistake cannot lock you out.
Add every address that needs the panel - your office, a VPN, another server that calls it. Turning the restriction off asks for confirmation.
reqad auth firewall off on the server. The saved list is kept for when you turn it on again.Sessions and the security log
Active sessions lists every logged-in browser with its address and how it logged in (2FA, trusted device, passkey). Revoke ends one; Log out all other sessions ends the rest. The Security log records logins, failures, blocks and every security change, newest first.
Locked out?
Everything on this page can be undone from the server as root, over SSH:
| Problem | Command |
|---|---|
| Forgot the password | reqad auth passwd |
| Lost the 2FA phone and recovery codes | reqad auth 2fa-reset |
| The email code does not arrive | reqad auth email-code off |
| A device with a passkey was lost | reqad auth passkeys --remove-all |
| Your address is blocked | reqad auth unban 203.0.113.7 |
| The IP restriction keeps you out | reqad auth firewall off |
| Someone else is logged in | reqad auth logout, then reqad auth passwd |
| Rather have the browser prompt back | reqad auth mode basic |
See Command line for every reqad auth command.
Need a hand? Create a free account or contact us.