Your MdmHost account controls your servers, their passwords and your billing. Anyone who gets into it can read server credentials, reinstall a server or cancel it. Securing the account takes about fifteen minutes and is one of the most valuable things you can do. This guide covers passwords, two-factor authentication, who can sign in, and how to spot phishing.
Before you start
- You are signed in to the Dashboard.
- A password manager, such as the one built into your browser or a dedicated app.
- An authenticator app on your phone. Common choices include Google Authenticator, Microsoft Authenticator and other TOTP apps. Many password managers can also generate codes.
Use a strong, unique password
A strong password is long and random, and you use it only for MdmHost. Reused passwords are the most common way accounts are taken over: when another site leaks your password, attackers try it everywhere.
- Let your password manager generate a password of at least 16 characters.
- In the Dashboard, open the account area and choose Security.
- Use Change password to set the new one.
- Save it in your password manager at the same time.
Tip: The password for your Dashboard account and the passwords for your servers are separate. Change both, and keep both in your password manager.
Turn on two-factor authentication
Two-factor authentication (2FA) asks for a short code from your phone as well as your password. Even if someone steals your password, they cannot sign in without the code.
- In Security, find Two-factor authentication.
- Choose to add an authenticator app.
- Scan the QR code shown on screen with your authenticator app. The app starts showing a six-digit code that changes every 30 seconds.
- Enter the current code to confirm.
- If backup or recovery codes are shown, save them in your password manager or print them and keep them somewhere safe.
Warning: If you lose your phone and have no backup codes, getting back into the account is slow. Save the backup codes before you leave the page, and move your authenticator to a new phone before wiping the old one.
Protect your sign-in email
Password reset links go to your Login email. If someone controls that mailbox, they can reset your MdmHost password.
- Use an email address only you control, not a shared mailbox.
- Turn on 2FA for the email account too.
- Keep it current. You can change it under Login email in Security.
Review who can sign in
Under Security, the Users with access section lists everyone who can sign in to the account.
- Check the list now and remove anyone who no longer needs access.
- Give new team members their own access instead of sharing your login.
- For people who only need emails, such as an accountant, add them as a contact instead. Contacts receive emails but cannot sign in.
Spot phishing emails
Phishing emails pretend to come from a company you use so that you click a link and type your password into a fake page. Warning signs:
- Urgency: "Your server will be deleted in 2 hours unless you log in now."
- A link to a look-alike address, such as an extra word or a misspelling in the domain. Hover over the link to see the real address before you click.
- Requests for passwords, 2FA codes or card numbers by email or chat.
- New bank details for paying an invoice.
The safe habit is simple: do not sign in through email links. Type the MdmHost address yourself, or use a bookmark, then check for the invoice or message in the Dashboard.
Warning: Never give anyone your 2FA code, even if they say they are from support. The code is only for you to type into the real sign-in page.
Check it works
- Sign out, then sign in again. You should be asked for your password and then a 2FA code.
- Confirm the new password is saved in your password manager, and the backup codes are stored safely.
- Check that Users with access shows only people you expect.
- Check that the Login email is correct and that you can receive mail there.
Troubleshooting
- The 2FA code is rejected: the clock on your phone is probably wrong. Set it to update automatically, then try a fresh code.
- You lost your phone: use a backup code to sign in, then set up 2FA again on the new phone. Without backup codes, contact support through the contact page.
- You forgot your password: use Forgot your password? on the sign-in page to get a reset link by email.
- You think someone else signed in: change your password, check Users with access, then change the passwords on your servers and open a ticket.
Next steps
- Secure the servers as well: Change your Windows server password safely or Set up SSH keys.
- Add an accountant without giving them a login: Add a contact to your MdmHost account.
- Keep your contact details current: Update your profile and contact details.