Password Recovery

If an administrator forgot their password (or nobody who can still sign in is an admin), reset it from the server’s console — over SSH or a local terminal. No sign-in is needed, but the command only works under sudo.

Reset a password


$ sudo quazzar-cli admin reset-password
Email: [email protected]
New password: ********
Confirm password: ********
✓ Password for [email protected] (admin) reset; 3 sessions signed out.

Enter the email of the account to reset (letter case doesn’t matter).
Type the new password twice. It is hidden while you type and must be at least 8 characters.

What happens after a reset:

All sessions of that user are signed out — every browser and device has to sign in again with the new password.
The reset is audited — it is written to the security (activity) log as auth.password_reset and appears on the system timeline, including which local account ran it.

Also lost the authenticator app?

Add --reset-2fa to turn off two-factor authentication and delete the account’s backup codes:


sudo quazzar-cli admin reset-password --reset-2fa

Turn 2FA back on in the profile settings after signing in.

Forgot the admin’s email?

List the accounts on the server:


sudo quazzar-cli admin users

It shows each account’s email, name, role and whether 2FA is on.

Docker

The CLI is included in the Cloud OS image, and the container runs as root — run it inside the container:


docker exec -it <container> quazzar-cli admin reset-password

Kubernetes

The Helm chart runs the pod as a non-root user (uid 65534), so kubectl exec … quazzar-cli admin reset-password is refused by the root-only check. If you sign in through SSO, restore access in your identity provider. Otherwise run the pod as root for the reset (podSecurityContext.runAsUser: 0 in the chart values), run kubectl exec -it <pod> -- quazzar-cli admin reset-password, and then revert the setting.

Why sudo only

The CLI talks to the running Quazzar service over a local admin socket (<data dir>/run/admin.sock, by default /var/lib/quazzar/run/admin.sock). The socket never listens on the network, and the service checks who is connecting and accepts root only — not even the quazzar service account can reset a password. The CLI itself refuses to start without root.

Troubleshooting

Message	What to do
`this command must be run as root` / `permission denied` / `closed the connection`	Run the command with `sudo`.
`no admin socket … the Quazzar service isn't running`	Start the service: `sudo systemctl start quazzar`. If it is running, the server is older than the CLI — update Cloud OS.
`no user with email …`	Check the email with `sudo quazzar-cli admin users`.
`passwords do not match` / too short	Type the same password twice, at least 8 characters.

For scripting (--email, piping the password on stdin, --json, a custom --socket), see the CLI reference.