Posted on by harlan

Locked Out of Sophos UTM 9.2 WebAdmin by OTP? Disable It from the Shell

While testing Sophos UTM 9.2’s one-time password (OTP) feature with Google Authenticator, I locked myself out of WebAdmin. Here’s how to turn OTP off for WebAdmin from the console using the cc configuration tool.

Steps to Disable WebAdmin OTP

1. Log in to the firewall console as root and start the configuration tool:

cc

2. Type auth and press Enter. It lists:

ad_sso
auto_add_to_facility@
auto_add_users$
block
cache_lifetime$
edir_sso
otp
servers@

3. Type otp and press Enter. It lists:

auto_create_token$
default_timestep$
facilities@
require_all_users$
required_users@
status$

4. Type facilities@ and press Enter. It shows which services require OTP:

0 webadmin
1 portal
2 ipsec
3 openvpn

5. Type -0 and press Enter to remove webadmin from the list. It now shows:

0 portal
1 ipsec
3 openvpn

6. Log in to WebAdmin as admin with just your password. Once you’re back in, you can reconfigure OTP properly.