Unable to login - Can't disable 2FA?

need4swede

Hi osTicket team,

For some reason our 2FA emails are not sending:

A message that you sent was rejected by the local scanning code that
checks incoming messages on this system. The following error was given:

  "Relaying not permitted"

So we are not getting the 2FA email. I logged into the database and I set require_agent_2FA to 0 and I removed 2fa_email from the default method value...but when I try to login, it still asks for 2FA. How can I go about turning it off so we can login?

Thanks!

KevinTheJedi

need4swede

The error means your SMTP settings are not correct for the System Email sending the 2FA emails. Relaying not permitted means you are using a relay host/port and your mailserver does not allow that.

To be able to login again login to your osTicket database, go to the _plugin table, disable the plugin (set isactive to 0), go to the _plugin_instance table, and disable the plugin instance (set flags to 0). Now go to the _config table, search for key LIKE '%2fa%', and delete any records associated with your Agent account (should have namespace similar to staff.staff_id where staff_id will be your actual Staff ID - eg. staff.123). Then you can login and update your email settings and confirm 2FA emails are sending again.

Cheers.

KevinTheJedi

need4swede

Just note that once you delete the _config table records for your Agent Account you will need to reconfigure your 2FA for your Agent Account (and any other Accounts you deleted the records for) after you confirm 2FA emails are working again.

Cheers.

KevinTheJedi

need4swede

One last thing, the error above might not be due to the SMTP/email settings it could also be due to your email routing via your mail provider (such as spam filtering, forwarding rules, etc.). It's highly advisable that you reach out to your mailserver admin for further assistance in tracking down the root cause. I will say that this is not an osTicket issue, rather the SMTP/email settings and/or mailserver routing.

Cheers.

need4swede

Kevin, you are awesome. Thank you!
I am back in and everything is working! The mailing issue was just me having to re-auth. Is that normal? Click to configure it and it had me log back in to our O365 account and then it worked again.

Also, I setup email and the auth app as 2fa options. I set email as our default. Is there a way to have the secondary auth option also be available during login? If the email is not working, there's no way to pick the authenticator as a secondary option...unless you're already logged in? Maybe I'm messing something up....

KevinTheJedi

need4swede

Having to re-auth could mean one of two things:

You are running v1.18 and an older build of the OAuth2 Plugin. You should really upgrade to v1.18.1 and install the latest build of the OAuth2 Plugin for 1.18.x. There was a bug with the older version of osTicket and older build of OAuth2 Plugin that failed to update the Refresh Token each time it renewed; specifically for O365 environments. Upgrading both osTicket and the Plugin should eliminate this factor.
Something with the account changed in O365 (ie. password change, etc.) which invalidates any tokens in-use generated for the account in question. Simply re-authenticating and retrieving a new token should always address this factor.

Unfortunately at this moment it's an either/or situation. Meaning you can configure it per-Agent to be either Email or Authenticator App or Disabled completely. For Agents to configure an Authenticator App first you need to install/activate the 2FA Plugin for 1.18.x. Next you must add a 2FA Plugin Instance and Enable it. Note, the "Issuer" will simply be the label shown in the Authenticator App when an Agent sets theirs up. For an Agent to configure an Authenticator App at this point they would need to go to their Profile, click Configure, click the new "Authenticator" option, and they can scan the code to start the process. Once complete they can set their Default 2FA to their desired 2FA method of Email or Authenticator App.

Cheers.

need4swede

KevinTheJedi

Hi Kevin,

Really appreciate the thorough response. Thank you, so very much! I'm going to start preparing for the 18.1 upgrade.
This may seem silly, but is there a way for me to know which files have been effected in the update? I do write a lot of my own custom changes to the codebase and I was just wondering what files are effected so that I can just overwrite those instead of having to redo everything.

To avoid potential future lockouts if the email doesn't work, I'm going to create a backup admin account setup with the auth app that can always go in even if the emails aren't sending. That'll do as a workaround for now!

Thanks again, Kevin!

KevinTheJedi

need4swede

You can review the Release Notes here for specific changes:

https://github.com/osTicket/osTicket/releases

You can also run the local diff command via linux cli.

Cheers.