Passwords, the recovery key & break-glass

Whatever credential is lost — the CLI admin password, the web super admin password, even a required security key — there is a supported path back in. None of them require reinstalling.

The two account systems

An Innovexus appliance has two separate sets of administrators, and knowing which one you are locked out of tells you which procedure to use:

	CLI administrator	Web administrators
Account	`admin` — exactly one, built into the appliance	Created in the browser; any number, with roles (`super_admin`, `admin`, …)
Logs in at	The console and SSH → the appliance CLI	`https://<fqdn>/login`
Wrong-password lockout	5 attempts → locked 15 minutes	5 attempts → locked 30 minutes
Self-service change	CLI command `password`	Web UI profile settings
Lost-credential recovery	Recovery key at the console (below)	`web-admin reset` from the CLI (below)

Why is there nothing on the login page? By design. A “recovery” feature on the public login page would be reachable by every device that can reach the appliance — an oracle for attackers to hammer. Break-glass on an Innovexus appliance always goes through the console or the authenticated CLI, so using it requires something an attacker on the network does not have: administrative access to the machine itself.

The recovery key

At first-boot setup, right after you choose the admin password, the appliance prints a one-time 96-character recovery key:

  =====================================================================
   ADMINISTRATOR RECOVERY KEY — record this now; it is shown only once
  =====================================================================
   4be21f0a9c…  (96 hex characters)
  ---------------------------------------------------------------------
   If the 'admin' password is ever lost: at the appliance console log
   in as 'recover' (no password) and enter this key to set a new one.
   The key is NOT stored on the appliance — only a hash of it is.
  =====================================================================

Store it like a credential — a password manager or a sealed envelope, not a sticky note on the hypervisor.
Only a SHA-256 hash lives on the appliance; the key itself cannot be read back, ever.
Check whether one is set, or rotate it, from the CLI at any time:

innovexus> recovery-key status
recovery key: set (2026-08-25 14:02) — console login 'recover' accepts it
innovexus> recovery-key regenerate
Issue a new recovery key? The current one stops working. [y/N] y
…new key printed once — record it…

Procedure 1 — lost the CLI `admin` password

This works only at the console (hypervisor screen / attached monitor). It is deliberately refused over SSH.

At the console login prompt, log in as recover — it has no password.
Enter your recovery key when asked.
Set a new admin password (minimum 8 characters).
The appliance prints a new recovery key — the old one is now void. Record the new one before pressing Enter.

innovexus login: recover

 Innovexus appliance — administrator password recovery
 Recovery key: <paste your 96-hex key — input is hidden>
 Key accepted. Set a new password for 'admin' (minimum 8 characters).
 New password: ********
 Retype password: ********
 Password for 'admin' updated. The old recovery key is now void.
 …a NEW recovery key is printed — record it…

Five wrong keys lock the recovery path for 15 minutes. Every attempt, right or wrong, is written to the system log.

No recovery key set? If the appliance was installed unattended and nobody ever ran recovery-key regenerate, there is no key to use — and without the admin password there is no supported way into a lost appliance. Reinstall and restore from a backup export. Set a key today: recovery-key regenerate.

Procedure 2 — lost a web administrator password (or their security key)

Web administrators — including the super admin — are reset from the appliance CLI with web-admin reset. This is the console analogue of the “application reset-passwd” command familiar from other network appliances.

Log in as admin on the console or SSH.
Optionally list the web accounts first:

innovexus> web-admin list
USERNAME                 ROLE         ACTIVE   LAST LOGIN
jsmith                   super_admin  yes      2026-08-24T16:41:03
noc                      admin        yes      2026-08-22T09:15:44

Run the reset and follow the prompts:

innovexus> web-admin reset
This resets a WEB interface administrator's password (not this CLI
account). Use it when the web super admin is locked out.
Continue? [y/N] y
…account list shown…
Web administrator username to reset: jsmith
New password (min 8 chars): ********
Retype password: ********
Also clear a passkey/YubiKey REQUIREMENT on this account (lost token)? [y/N] n
password reset for 'jsmith' (role super_admin)
the account is active and unlocked — sign in at the web UI now

The reset also re-activates the account and clears any failed-login lockout, so the new password works immediately. Answer y to the last question only when the administrator’s security key/passkey is genuinely lost — it lifts the hardware-token requirement so they can sign in with the password and register a new token (details).

The full break-glass chain

The two procedures compose. Even in the worst case — every password lost — physical/console access plus the recovery key recovers everything:

Recovery key→ console login recover→ new CLI admin password→ web-admin reset→ sign in at https://<fqdn>/login

Every link in that chain requires console-level access to the appliance; nothing about it is reachable from the network alone.

Quick reference

Lost…	Do this
CLI `admin` password	Console → log in as `recover` → recovery key → new password
Web admin password	CLI → `web-admin reset`
Web admin’s YubiKey / passkey	CLI → `web-admin reset` → answer y to clear the token requirement → register a new token
Recovery key (but you still know the admin password)	CLI → `recovery-key regenerate`
Both the admin password and the recovery key	No supported path — reinstall and restore from a backup. This is deliberate: if this were recoverable, so could an attacker with your hardware.