Syncovery Web GUI Login Help

Syncovery 12.10 protects the login of the web GUI more strictly than earlier versions. This page explains the login rules, how to create the first login, how the second factor works, and what to do if you cannot log in.

What changed in Syncovery 12.10

  • No default password. There is no preset login such as “admin” / “pass” any more. When you open the web GUI of a new installation, you create the login yourself.
  • Passwords need at least 8 characters, and very common passwords are not accepted. They are stored only as salted, slow hashes, never in readable form.
  • Failed logins are limited. After 10 failed attempts within 15 minutes, for the same user name or from the same address, further attempts are refused until the 15 minutes have passed.
  • Logins from the Internet need a second factor: a code from an authenticator app, or a code sent by e-mail. Without one, such logins are refused.
  • Login recovery works only through a folder that an administrator of the machine creates (see below). The former fixed recovery password no longer exists.

Creating the first login

When no login exists yet, the web GUI shows the page “Create the Login for the Web GUI”. Choose a user name and a password with at least 8 characters.

For security, the first login can be created:

  • from the computer or NAS that Syncovery runs on, at any time;
  • from your local network, within 60 minutes after Syncovery was started;
  • never from the Internet.

If the 60 minutes have passed, restart Syncovery (on a NAS: stop and start the Syncovery package in the App Center or Package Center) and reload the page.

On Windows and macOS, you can also set the web GUI login in the Program Settings of the Syncovery desktop program.

Logins from the Internet need a second factor

Syncovery checks the address of every login. Addresses of your local network (such as 192.168.x.x, 10.x.x.x or VPN ranges like 100.64.x.x) and the computer itself are local. Every other address is treated as the public Internet, and a login from there always needs a second factor, also for user accounts and for the read-only login.

For local logins, the second factor is optional. An administrator can require it for all logins in the Program Settings (Second Factor).

Setting up an authenticator app

Log in from your local network or from the machine itself, open the Program Settings, section Second Factor, and click “Set Up Authenticator App”. Scan the QR code with an app such as Google Authenticator, Microsoft Authenticator or FreeOTP, and enter the code that the app shows to confirm it. Every login sets up its own app.

To replace or remove an app that is already set up, you need a current code from that app. The password alone is not enough, so nobody who only knows your password can swap in their own app.

Login codes by e-mail

Instead of an app, a login can receive its code by e-mail. An administrator enters an SMTP server in the Program Settings (Second Factor) and switches on “Send login codes by e-mail”. The admin login and the read-only login use the e-mail addresses entered in the Program Settings; user accounts use the address in their account.

The mail is sent only over an encrypted connection (SSL/TLS, or STARTTLS on ports such as 587 or 25). A code is valid for 10 minutes, can be used once, and allows 5 attempts.

Trusted addresses and reverse proxies

In the Program Settings (Second Factor, Advanced), an administrator can enter:

  • Trusted public addresses, for example the fixed address of your office or of a VPN gateway. Logins from them are treated like local ones.
  • Trusted reverse proxies, if you reach the web GUI through nginx, Apache or the reverse proxy of a NAS. Syncovery then takes the real address of the browser from the proxy’s X-Forwarded-For header. Without this entry, every request that carries such a header counts as coming from the Internet.

If you cannot log in

Too many failed attempts

After 10 failed attempts within 15 minutes, logins for that user name or from that address are refused for a while. Wait 15 minutes and try again with the correct password.

“This login comes from a public Internet address, so it needs a second factor”

Your login has no second factor yet. Either log in once from your local network or from the machine itself and set one up (see above), or, if you can reach the web GUI only from the Internet, set it up on the server itself with the command line (Linux and macOS):

sudo SyncoveryCL SETUP2FA

The command lists the logins with their current second factor and lets you choose an authenticator app (the QR code is shown in the terminal) or login codes by e-mail. The new app or e-mail address is stored only after you have entered a correct code from it. Only root or the owner of the Syncovery configuration may run the command, and it must be run in a terminal. Every change is recorded in the file WebGUI.log.

The authenticator app is lost

  • An administrator can remove the app of another login in the web GUI: Program Settings, Second Factor.
  • On Windows and macOS, the desktop program can remove the apps of the admin login and the read-only login: Program Settings, “Second Factor for Web GUI Logins”.
  • On Linux and macOS, sudo SyncoveryCL SETUP2FA can replace the app of any login with a new one.

The password is forgotten: the SyncoveryLogin folder (Linux and NAS)

Syncovery can write a one-time recovery password into a folder that only an administrator of the machine can create. Creating the folder is what switches the recovery on; without it, there is no recovery password.

  1. As root, create the folder /etc/SyncoveryLogin, for example with sudo mkdir -m 700 /etc/SyncoveryLogin. It must belong to root (or to the user that Syncovery runs as), and nobody else may be able to write to it. A folder named SyncoveryLogin in the Syncovery work folder (where its configuration files are) works too.
  2. On Synology, QNAP and ASUSTOR devices, an administrator can instead create a folder named SyncoveryLogin in the top level of any shared folder, using the NAS’s file manager. It must belong to a member of the administrators group, and other users must not have access to it.
  3. Try to log in to the web GUI, from your local network or the machine itself. The failed login makes Syncovery write the file recoverypassword.txt into the folder.
  4. Open the file. The password on its first line is valid for 10 minutes and works with any user name.
  5. Log in with it. Syncovery then asks you to set up a new login right away. With user management on, enter the name of an existing administrator account to set its password, or a new name to create an administrator account.

The password and the file are discarded after the 10 minutes. A login with the recovery password from the Internet needs a second factor like any other login, so use it from your local network or from the machine itself. You can delete the folder again afterwards; as long as it exists, every failed login creates a new recovery password in it.

Alternatively, as root, you can set a new password for the admin login with the command line:

sudo SyncoveryCL SET /WebPass=YourNewPassword

Note that the password then appears in your shell history.

The password is forgotten: Windows and macOS

Open the Syncovery desktop program on that computer and set a new web GUI password in the Program Settings. If user management is on, an administrator can also set a new password for a user account in the web GUI or in the desktop program.

Where to find more information

Every refused login, every use of the recovery password and every change of a second factor is recorded in the file WebGUI.log in the Syncovery configuration folder. If you still cannot log in, please contact our support and include the relevant lines of this file. Do not send passwords, recovery passwords or codes.