Account security — two-step authentication and emergency access

The Castreon panel starts and stops channels, so the administrator account must be protected like access to the server. In short: a long password, two-step authentication on and the recovery codes kept safe.

Available from Castreon 1.6.0, in all plans.

Password

• New passwords have at least 15 characters — or 12 if two-step authentication is on. No digits or symbols are required: length is what counts (as in NIST's 2025 guidance).
• Common passwords or ones seen in data leaks, the account name and “castreon” are refused. The form shows on the spot what is missing; Change password becomes active only with a good password.
• Existing passwords stay valid. An account with a password generated by another administrator (or reset from the console) chooses a new one at the first sign-in.

Two-step authentication

My account → Two-step authentication:

1. Scan the QR code with your authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden …) or type the code shown below it. The QR code is made in the browser — the secret goes nowhere.
2. Type the 6-digit code from the app to confirm that the app and the server agree.
3. You get 10 recovery codes. Save them now — Download (.txt), copy them into your password manager or print them — not on the same phone. They are shown only once.

From then on every sign-in asks for the code from the app. A code that has been used does not work a second time.

Recovery codes

• If your phone is not at hand, type a recovery code instead of the app code. Each works only once; after signing in you see how many are left.
• New codes (with your password) creates another 10 — the old ones stop working.
• Every use appears in Audit.

Organisations that want 2FA for all administrators require it under Settings → Sign-in → Require 2FA for all administrators. The page shows how many administrators already have 2FA and who does not; before saving it names them again and asks for confirmation. An administrator without 2FA then sees only My account until they turn it on; operators and read-only users are not affected. The rule can be switched on only from an account that already has 2FA. In the same place you choose the sign-in duration (12 hours by default, at most 720 = 30 days), after which the panel asks for the password and the code again. Through the API: PUT /api/v1/settings with security.totp_required_for_admins and security.session_hours.

I lost access

• Another administrator can generate a new password for you: Users → your row → Generate (the password is temporary — you change it at the first sign-in). It does not work on your own account: your own password is changed under My account.
• You lost your phone: sign in with a recovery code, then turn 2FA on again with the new phone.
• You are the only administrator (or nobody can sign in): emergency access from the server console, as root:

sudo /opt/castreon/bin/castreon -list-users
sudo /opt/castreon/bin/castreon -reset-password admin

You type the password twice without it appearing on screen (or -generate creates one and shows it once). -disable-2fa also switches 2FA off (phone and codes lost). A copy of the database is made before the change; the account's sessions are closed and everything appears in Audit (“server console”). If several Castreon services run on the server, choose one with -config <path>.

The last active administrator cannot be disabled, demoted or deleted — the panel is never left without someone who can administer it.