MFA and account recovery

Enable MFA

Open your Access/Profile controls and enable TOTP MFA. Scan the setup code with a compatible authenticator, verify the first code and store the recovery codes somewhere secure and separate from the server.

Recovery codes are one-time credentials. Remove a used code from your own records and regenerate codes if their secrecy is uncertain.

Administrator recovery

If an existing Administrator cannot sign in and normal recovery is unavailable, use the server-local Administrator recovery procedure documented with the installed Control release. Recovery creates a short-lived one-time token and revokes the recovered Administrator's existing sessions and API tokens after the password is replaced.

Because this procedure requires server access, protect SSH/root access independently from Control.

Host terminal access

The host terminal requires an Administrator browser session with two-factor authentication enabled. Before starting a root session, confirm your account password and current authenticator code. This extra check expires after a short period; use Verify & Continue to reauthenticate an active terminal session when prompted.

If you cannot access the terminal, use your provider's server console or established recovery access. One-time account recovery codes do not replace the terminal's authenticator-code check.