Two-factor authentication requires the end-user to provide a token after initially logging into Nagios XI. We will receive the token as a email and if we don’t use it, it will expire after a set amount of time.

Two factor authentication sends an email to the address associated with a user account.

If a user is not receiving the emails then the first step is to confirm their email address is correct via Admin > Users > Manage Users.

You need to be an administrative user to be able to manage users, if you are unable to login as an administrative user.

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to perform several Nagios queries.

In this context, we shall look into methods to resolve issues with two-factor authentication.

Nature of Nagios error Unable To Login Using Two Factor Authentication

Here, we you will learn how to make things work.

Enable Two Factor Authentication

Initially, login as an administrative account and navigate to Admin > System Config > System Settings.

On the Security tab, we will find the two-factor authentication settings:

i. Enable Two Factor Auth: We need to check this box to enable the functionality

ii. TwoFactor Token Timeout: This setting defines how long the token will remain active before it expires.

iii. Two Factor Cookie: It allows the end-user to store a cookie on their computer that will not prompt them for the two-factor token when they log in.

iv. Two Factor Cookie Timeout: This setting defines how long the cookie remains valid before it expires.

After making these selections, we click the Update Settings button.

Once done, we will see the below prompt after logging into Nagios XI

Here, the "Remember this browser" checkbox will only appear if the "Two Factor Cookie" setting is enabled.

Confirm Correct Email Address

If we do not receive the emails, then the first step is to confirm the email address is correct via Admin > Users > Manage Users.

Cannot Login As nagiosadmin

If the only administrative account we have is the nagiosadmin account, it can lock us out of Nagios XI.

If we configure the nagiosadmin account with the default root@localhost email address, this can happen.

However, we can retrieve the token by looking at the /var/spool/mail/root mailbox on the Nagios XI server:

grep -A2 ‘token below’ /var/spool/mail/root

To continue logging in, please enter the token below:

16616
—
To continue logging in, please enter the token below:<br />
<br />
16616<br />

The output shows the token is 16616.

We can use this to log in to the Nagios XI system as the nagiosadmin account.

Then, we can change the nagiosadmin account to the correct email address.

If we fail to retrieve the token from the /var/spool/mail/root mailbox, then it is likely that the nagiosadmin account has an email address we are unaware of. 

In this scenario, we have to reset the nagiosadmin account which also disables two-factor authentication.

To reset nagiosadmin password, we open an SSH or direct console session to Nagios XI host and run:

/usr/local/nagiosxi/scripts/reset_nagiosadmin_password.php –password=newpassword

If we want to add special characters in the password, we should escape them with "\".

For example, suppose, we want it to be "$new password#":

/usr/local/nagiosxi/scripts/reset_nagiosadmin_password.php –password=\$new\ password\#

[Need help with fixing Nagios errors? We can help you. ]