Locked out? Get back in from SSH

Lost the phone with your two-factor app, the recovery codes, a passkey's device — or simply the password? As long as you can sign in to the server over SSH as root (or a user that can sudo), you can get any panel login back: the administrator's, a reseller's or a customer's.

Everything below is one command, bhpanel-access, run on the server. Run it as root, or put sudo in front.

bhpanel-access status <login>

It shows whether the login is an administrator, a reseller or a customer, whether two-factor is on (and how many recovery codes are left), how many passkeys it has, and whether sign-in is paused after too many wrong passwords.

Set a new password

bhpanel-access password <login>

You type the new password twice; it is never on the command line, so it does not end up in the shell history or in the process list. Everywhere the login was signed in is signed out. Two-factor stays as it was — turn it off separately if the phone is gone too.

Turn two-factor off

bhpanel-access 2fa-off <login>

The password alone signs in afterwards. Sign in, then turn two-factor on again under Edit profile › Two-factor with your new phone — it is worth it. Its old recovery codes stop working. A customer or reseller is emailed that it was turned off.

For an administrator, the panel's terminal stays closed until two-factor is on again: sign in, set up two-factor under Edit profile › Two-factor, and then open the terminal.

Passkeys

bhpanel-access passkeys <login>         # list them
bhpanel-access passkeys-reset <login>   # remove all of them

Use this when a device with a passkey is lost, stolen or replaced. Also delete the passkey from the device itself (its password manager or settings), or it keeps offering it. To remove just one passkey, an administrator can use Server › Passkeys in the panel instead.

After five wrong passwords the panel pauses sign-in for that login for 15 minutes. To open it again straight away:

bhpanel-access unlock <login>

The pause belongs to the login's name: when an administrator and a hosting account share one, unlock opens it for both.

Wrong passwords also pause the address they came from, for every login. If the command says your address is still paused — you mistyped from your own office — open it too:

bhpanel-access unlock-ip 203.0.113.7

Only do that for an address you know is yours: it hands back the guesses for every login from that address.

A name that is both

If an administrator login and a hosting account have the same name, the command asks which one you mean — add --admin or --account:

bhpanel-access 2fa-off john --account

Everything at once — the administrator who lost it all

sudo bhpanel-access status admin
sudo bhpanel-access password admin
sudo bhpanel-access 2fa-off admin
sudo bhpanel-access passkeys-reset admin
sudo bhpanel-access unlock admin        # and unlock-ip <your address>, if it says so

Then sign in with the new password at https://<your server>:2087, and set up two-factor and a passkey again under Edit profile. The panel's terminal opens again once two-factor is on.

Forgot the administrator's name too? sudo bhpanel-web-admin list lists the administrator logins.

Why only from the server

These commands work only for root on the server itself. The web panel cannot call them, and neither can a customer with SSH access to their own account: whoever can use them already controls the whole server. That is also why nothing here asks for a password or a code — root is the server's owner.

A customer who cannot get in does not need SSH: their administrator (or their reseller) can turn their two-factor off and reset their password from the panel — see Securing your server.