Login and Session
Login and Session explains password sign-in, conditional two-factor authentication, server-side session validation, and safe sign-out.
Where to find it: The SDM sign-in page and the account/logout controls in the panel header.
Available to: All panel users; root controls global rate limits and account administrators can reset relevant user security state.
What this page does
SDM first verifies username and password, then requests a six-digit code when 2FA is enabled. A successful login creates a revocable native session token and browser session; the server revalidates account state and uses CSRF protection for mutations.
Before you start
Use the correct panel hostname, a current named account, and a trusted device. Have the authenticator available when 2FA is enabled. External API keys are not panel passwords.
Sign-in states
- Username and Password: the first step for every account.
- 2FA Code: appears only after valid primary credentials for a 2FA-enabled account.
- Start Over: abandons the pending second-factor state and returns to username/password.
- Rate limited or blocked: repeated failures may trigger the configured window and block policy.
- Session revoked: disablement, password reset, selected 2FA actions, deletion, or logout invalidates relevant server-side access.
Controls and fields
| Control, Field, Or Section | What It Does | What It Affects | Recommended Usage |
|---|---|---|---|
| Username | Panel account name used to identify the user. | Determines role, zone access, API key ownership, and security policy checks. | Use the assigned SDM username exactly; repeated wrong attempts can trigger protection. |
| Password | Primary account secret. | Authenticates the browser session before 2FA is considered. | Use strong passwords and never share root credentials with normal users. |
| 2FA Code | One-time authenticator code shown only when the account requires 2FA. | Completes the second authentication step. | Enter the current six-digit code; if it fails repeatedly, check device time sync. |
| Sign In | Submits credentials, checks source IP policy, rate-limit state, and 2FA requirement. | Creates a panel session only after all checks pass. | If sign-in fails, check username/password first, then IP rules, 2FA, and rate-limit blocks. |
| Start Over | Clears a partially completed login or 2FA challenge. | Returns the form to normal username/password entry. | Use when the wrong user was entered or the 2FA challenge is stale. |
Safety notes
- Repeated failed login attempts can trigger rate limiting or temporary IP blocks.
- If IP access control is configured, a correct password still fails from an untrusted IP.
How to use it
- Enter username and password and select Sign In.
- If prompted, enter the current six-digit authenticator code.
- Confirm the expected role and pages.
- When leaving a shared or support workstation, use Logout rather than closing only the tab.
- If the account is unexpectedly rejected, ask root to check active state, panel IP rules, 2FA state, and rate-limit blocks.
Result and next check
A valid account receives a server-validated session limited to its current role and scope. Logout or security changes revoke that access instead of leaving a reusable browser token behind.
Theme color