[GH-ISSUE #1591] "I changed my phone and didn't backup 2FA. How can I disable it on the server?" #2728

Closed
opened 2026-08-05 00:48:38 -04:00 by saavagebueno · 4 comments
Owner

Originally created by @williamcanon1 on GitHub (Feb 18, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/1591

"I changed my phone and didn't backup 2FA. How can I disable it on the server?"

Originally created by @williamcanon1 on GitHub (Feb 18, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/1591 "I changed my phone and didn't backup 2FA. How can I disable it on the server?"
saavagebueno added the waiting-feedbackquestion labels 2026-08-05 00:48:38 -04:00
Author
Owner

@jiangslee commented on GitHub (Feb 26, 2024):

Maybe you can try connecting to crdb to modify the configuration of "second_factors".

My steps:

  1. Modify docker-compose.yml and execute docker compose up crdb -d to expose the 26257 port of crdb to the host.
  2. Modify your system /etc/hosts and add 127.0.0.1 crdb
  3. Copy certs from crdb.
    mkdir zitadel-certs && docker compose cp -a crdb:/zitadel-certs zitadel-certs/
  4. Use navicat or other tools to connect to crdb. SSL uses the file in zitadel-certs from the step3.

image

image

Modify the second_factors filed value from {1, 2}to {2}

image

This is a dangerous operation. Please don't use it in a production environment.

<!-- gh-comment-id:1965700545 --> @jiangslee commented on GitHub (Feb 26, 2024): Maybe you can try connecting to crdb to modify the configuration of "second_factors". My steps: 1. Modify `docker-compose.yml` and execute `docker compose up crdb -d` to expose the 26257 port of crdb to the host. 2. Modify your system `/etc/hosts` and add `127.0.0.1 crdb` 3. Copy certs from crdb. `mkdir zitadel-certs && docker compose cp -a crdb:/zitadel-certs zitadel-certs/` 5. Use navicat or other tools to connect to crdb. SSL uses the file in zitadel-certs from the step3. ![image](https://github.com/netbirdio/netbird/assets/27892476/a3696bd1-780b-4e69-b3b1-2e36209a914f) ![image](https://github.com/netbirdio/netbird/assets/27892476/505a1f38-3f32-44f7-8965-9cc46fd68471) Modify the `second_factors` filed value from `{1, 2}`to `{2}` ![image](https://github.com/netbirdio/netbird/assets/27892476/29fad27c-6da6-400b-a165-d5efbb421f99) **This is a dangerous operation. Please don't use it in a production environment.**
Author
Owner

@jiangslee commented on GitHub (Feb 26, 2024):

Or you can try this.

root@ecs01:~/docker-netbird# docker compose exec crdb cockroach sql -u root -d zitadel --host crdb --certs-dir /zitadel-certs/
#
# Welcome to the CockroachDB SQL shell.
# All statements must be terminated by a semicolon.
# To exit, type: \q.
#
# Server version: CockroachDB CCL v22.2.2 (x86_64-pc-linux-gnu, built 2023/01/04 17:23:00, go1.19.1) (same version as client)
# Cluster ID: 6d93***6329
#
# Enter \? for a brief introduction.
#
root@crdb:26257/zitadel> select * from projections.login_policies5;
     aggregate_id    |    instance_id     |        creation_date         |          change_date          | sequence | is_default | allow_register | allow_username_password | allow_external_idps | force_mfa | force_mfa_local_only | second_factors | multi_factors | passwordless_type | hide_password_reset | ignore_unknown_usernames | allow_domain_discovery | disable_login_with_email | disable_login_with_phone | default_redirect_uri | password_check_lifetime | external_login_check_lifetime | mfa_init_skip_lifetime | second_factor_check_lifetime | multi_factor_check_lifetime | owner_removed
---------------------+--------------------+------------------------------+-------------------------------+----------+------------+----------------+-------------------------+---------------------+-----------+----------------------+----------------+---------------+-------------------+---------------------+--------------------------+------------------------+--------------------------+--------------------------+----------------------+-------------------------+-------------------------------+------------------------+------------------------------+-----------------------------+----------------
  255***1332 | 255***1332 | 2024-02-21 09:23:16.45078+00 | 2024-02-26 07:54:24.242073+00 |      279 |     t      |       f        |            t            |          t          |     f     |          f           | {1,2}          | {1}           |                 1 |          f          |            f             |           f            |            f             |            f             |                      |         864000000000000 |               864000000000000 |       2592000000000000 |               64800000000000 |              43200000000000 |       f
(1 row)


Time: 1ms total (execution 0ms / network 0ms)

root@crdb:26257/zitadel> update projections.login_policies5 set second_factors = '{2}' where instance_id = '255***1332';
UPDATE 1


Time: 2ms total (execution 2ms / network 0ms)

root@crdb:26257/zitadel> select * from projections.login_policies5;
     aggregate_id    |    instance_id     |        creation_date         |          change_date          | sequence | is_default | allow_register | allow_username_password | allow_external_idps | force_mfa | force_mfa_local_only | second_factors | multi_factors | passwordless_type | hide_password_reset | ignore_unknown_usernames | allow_domain_discovery | disable_login_with_email | disable_login_with_phone | default_redirect_uri | password_check_lifetime | external_login_check_lifetime | mfa_init_skip_lifetime | second_factor_check_lifetime | multi_factor_check_lifetime | owner_removed
---------------------+--------------------+------------------------------+-------------------------------+----------+------------+----------------+-------------------------+---------------------+-----------+----------------------+----------------+---------------+-------------------+---------------------+--------------------------+------------------------+--------------------------+--------------------------+----------------------+-------------------------+-------------------------------+------------------------+------------------------------+-----------------------------+----------------
  255***1332 | 255***1332 | 2024-02-21 09:23:16.45078+00 | 2024-02-26 07:54:24.242073+00 |      279 |     t      |       f        |            t            |          t          |     f     |          f           | {2}            | {1}           |                 1 |          f          |            f             |           f            |            f             |            f             |                      |         864000000000000 |               864000000000000 |       2592000000000000 |               64800000000000 |              43200000000000 |       f
(1 row)


Time: 1ms total (execution 1ms / network 0ms)
<!-- gh-comment-id:1965712968 --> @jiangslee commented on GitHub (Feb 26, 2024): Or you can try this. ``` root@ecs01:~/docker-netbird# docker compose exec crdb cockroach sql -u root -d zitadel --host crdb --certs-dir /zitadel-certs/ # # Welcome to the CockroachDB SQL shell. # All statements must be terminated by a semicolon. # To exit, type: \q. # # Server version: CockroachDB CCL v22.2.2 (x86_64-pc-linux-gnu, built 2023/01/04 17:23:00, go1.19.1) (same version as client) # Cluster ID: 6d93***6329 # # Enter \? for a brief introduction. # root@crdb:26257/zitadel> select * from projections.login_policies5; aggregate_id | instance_id | creation_date | change_date | sequence | is_default | allow_register | allow_username_password | allow_external_idps | force_mfa | force_mfa_local_only | second_factors | multi_factors | passwordless_type | hide_password_reset | ignore_unknown_usernames | allow_domain_discovery | disable_login_with_email | disable_login_with_phone | default_redirect_uri | password_check_lifetime | external_login_check_lifetime | mfa_init_skip_lifetime | second_factor_check_lifetime | multi_factor_check_lifetime | owner_removed ---------------------+--------------------+------------------------------+-------------------------------+----------+------------+----------------+-------------------------+---------------------+-----------+----------------------+----------------+---------------+-------------------+---------------------+--------------------------+------------------------+--------------------------+--------------------------+----------------------+-------------------------+-------------------------------+------------------------+------------------------------+-----------------------------+---------------- 255***1332 | 255***1332 | 2024-02-21 09:23:16.45078+00 | 2024-02-26 07:54:24.242073+00 | 279 | t | f | t | t | f | f | {1,2} | {1} | 1 | f | f | f | f | f | | 864000000000000 | 864000000000000 | 2592000000000000 | 64800000000000 | 43200000000000 | f (1 row) Time: 1ms total (execution 0ms / network 0ms) root@crdb:26257/zitadel> update projections.login_policies5 set second_factors = '{2}' where instance_id = '255***1332'; UPDATE 1 Time: 2ms total (execution 2ms / network 0ms) root@crdb:26257/zitadel> select * from projections.login_policies5; aggregate_id | instance_id | creation_date | change_date | sequence | is_default | allow_register | allow_username_password | allow_external_idps | force_mfa | force_mfa_local_only | second_factors | multi_factors | passwordless_type | hide_password_reset | ignore_unknown_usernames | allow_domain_discovery | disable_login_with_email | disable_login_with_phone | default_redirect_uri | password_check_lifetime | external_login_check_lifetime | mfa_init_skip_lifetime | second_factor_check_lifetime | multi_factor_check_lifetime | owner_removed ---------------------+--------------------+------------------------------+-------------------------------+----------+------------+----------------+-------------------------+---------------------+-----------+----------------------+----------------+---------------+-------------------+---------------------+--------------------------+------------------------+--------------------------+--------------------------+----------------------+-------------------------+-------------------------------+------------------------+------------------------------+-----------------------------+---------------- 255***1332 | 255***1332 | 2024-02-21 09:23:16.45078+00 | 2024-02-26 07:54:24.242073+00 | 279 | t | f | t | t | f | f | {2} | {1} | 1 | f | f | f | f | f | | 864000000000000 | 864000000000000 | 2592000000000000 | 64800000000000 | 43200000000000 | f (1 row) Time: 1ms total (execution 1ms / network 0ms) ```
Author
Owner

@nazarewk commented on GitHub (Apr 18, 2025):

@williamcanon1 for Cloud offering you can get in touch with support at netbird.io, we will verify ownership and reset your 2FA.

For the self-hosted, I guess there are enough instructions provided by the community member.

<!-- gh-comment-id:2815565051 --> @nazarewk commented on GitHub (Apr 18, 2025): @williamcanon1 for Cloud offering you can get in touch with support at netbird.io, we will verify ownership and reset your 2FA. For the self-hosted, I guess there are enough instructions provided by the community member.
Author
Owner

@mlsmaycon commented on GitHub (Jun 1, 2025):

closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

<!-- gh-comment-id:2927895580 --> @mlsmaycon commented on GitHub (Jun 1, 2025): closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#2728