Greetings,
I am trying to log in to the backend as the sole admin of the blog, but I am currently unable to access it. I noticed in the forum that some users have experienced similar issues, but those were related to two-factor authentication (2FA). In my case, I have not enabled 2FA — I am using only email and password authentication.
When I click the “Sign In” button, the button enters an infinite loading state and never logs me in.
I would appreciate any assistance in resolving this issue.
2fa is enabled by default. When you try to sign in with your email and password, if you are on an unrecognised device Ghost will send an email with a confirmation code which is likely the part that is failing due to broken mail config. The other topics you found should help you troubleshoot/fix.
My site is asking me for a verification number, but I never setup MFA and doesn’t send me a verification code either. Is there a way to remove MFA so I can access my admin panel to actually set it up?
It’s on by default in the latest versions of Ghost. It sends it to your email, assuming you’ve set up a mailserver already. Usually, setting up a mail server is the right answer, but if you need to disable device verification, you can do that.
If you used the Ghost CLI to install (or DO one-click), you’ll add this to config.production.json:
"security": {
"staffDeviceVerification": false
}
If you are using docker, you’ll need the corresponding environment variable, which is security__staffDeviceVerification
Thank you for this. My mail server is setup, but I am not getting those emails. I get other emails, but not those. I am not sure why.
That’s weird. Do magic link (sign-in/sign-up) emails work normally?
Yes. I was able to login to the basic site, but not the admin site. Same email.
So what do your logs say? Can you see Ghost trying to send the email? What does the receiving mailserver say?
and what comes right before/after that? Looking for an attempt to send email.
The quick answer was nothing before and after was the page being reset.
I figured out the answer. Google was immediately rejecting the email due to:
"5.7.1 [.11] Gmail has detected that this message is not RFC 5322 compliant: 'From' header is missing. To reduce the amount of spam sent to Gmail, this message has been blocked. For more information, go to https://support.google.com/mail/?p=RfcMessageNonCompliant and review RFC 5322 specifications. 6a1803df08f44-6fb35ad95d5si24549486d6.95 - gsmtp",
I changed the From to match the style of another site that works and retried the MFA login. Worked perfectly. Thank you for whatever you said that made me think to go look at mailgun.
Glad to help :) Have a great one!