Google authenticator - IP Ban

[Manolenta]

Hi!

I have been out on a large holidays travel and after I got home i found a big problem. I tried to access my server (HP G8 with xpenlogy installed) which has 2 steps authenticator enabled on the admin account using google app. It didn't work for 5 times and the ip got banned (my local network). I have been trying to access again using mobile network but google autenthicator doesn't work, and I got ssh disabled from external ips. So far, I can't access to my server with the admin account, and I can't access with ssh because the ip is banned.

 

Is it fixable? I don't know how to fix it, and I can't access with the main account.

 

- IP banned

- SSH from external ips not allowed

- Admin has 2 step-verification

[jensmander]

If you have a serial port (or usb to rs232 converter) and a cable you can establish a connection with putty. You’ll need a serial port on both systems (your PC/Laptop and your NAS). Connect each port with a null modem cable. Log in with your admin account and follow these steps:

 

https://www.ask-sheldon.com/reset-authenticator-synology-diskstation/?cn-reloaded=1

 

Another solution would be to boot a live linux system on your NAS. Then you would first have to mount your drives and then follow the steps described in the link above.

[lejurassien]

Hello,

Maybe if you try with a vpn your ip will be different and you will be able to unlock the situation...
You can use opera and activate the vpn of it is a simple and quick vpn solution to implement and then uninstall.
Then when the 6-digit code is asked you click on lost phone and an emergency code is sent to your email.
Otherwise I see only a reset...
But there are people more experienced than me who may have a solution.
Just one more question, do you remember if the expiry of the blocks was activated?

 Because if that's the case, all you have to do is wait for it to unlock itself.

Good luck

 

Translated with www.DeepL.com/Translator

Edited July 20, 2019 by lejurassien
img too small

[lejurassien]

I don't know if it's possible that this is the cause of your problem but in the last update 6.2.2.2.24922 update2 we read this

 

Fixed Issues:

 

Adjusted Gmail notification authentication mechanism to comply with the new Gmail API.

it may be the reason for connection failures ??...

 

https://www.synology.com/fr-fr/releaseNote/DS212+#ver_24922-2

[jensmander]

Without physical access and/or unblock expiry there’s no way to disable the 2FA. You can try (as written above) a VPN connection but if there’s a general problem with the 2FA you’ll get banned again.

[bearcat]

@Manolenta Did you try the "easy step" and change the IP on your banned client?

[Manolenta]

Hi all. Thanks for the anwers. I can't answer from my home, I get "dangerous web" or something similar and I can't post back...

As far as I understand, my only way to go is with physical access, right? I have tried, but, how to get a console directly from the server? I mean, I can plug a monitor and a keyboard, but I can't get a terminal as in other linux distributions...

[bearcat]

@Manolenta Where you able to change the IP on your client, to bypass the IP ban, letting you use SSH locally.