# Users and sessions

> Accounts, roles, two-factor authentication and sessions.

Source: https://quasar.achaverot.fr/docs/server/users/

## Users

Manage accounts in **Settings → Users**. There are two roles:

| Role | Can |
| --- | --- |
| **admin** | Do everything. |
| **viewer** | See every application, log, metric and audit entry, but change nothing. |

Viewers also can't open container terminals, download backups or the master key, read environment variables, or browse stored files. These give far more access than "read-only" suggests.

- Admins can change a user's role, reset their password, or delete them.
- The last admin account can't be demoted or deleted.

## Your account

**Settings → Account** changes your password. It signs out all your other sessions.

## Two-factor authentication

**Settings → Two-factor authentication**:

1. Click **Set up 2FA**.
2. Scan the QR code with an authenticator app, or enter the secret by hand.
3. Enter a code to confirm.

From then on, signing in asks for a code. To turn it off, confirm with your password.

## Sign-in protection

After too many wrong passwords or 2FA codes, an address is refused for a while: by default, **5 failures within 15 minutes** lock it out for **15 minutes**.

- While it is refused, the password isn't even checked, so guessing stops being useful.
- Failures are counted per address, not per account: someone guessing at `admin` can't lock you out from elsewhere.
- A successful sign-in clears the address's count.
- Every lockout is recorded in the audit log and the [dashboard log](/server/dashboard-log/).

**Settings → Sign-in protection** (admins only) sets the number of attempts (3 to 100) and the lock duration (1 minute to 24 hours), and lists the addresses refused right now, each with an **Unblock** button.

Locks are kept in memory: restarting the dashboard lifts them all.

:::note
Behind Cloudflare's proxy, Quasar counts each visitor under their own address, not Cloudflare's. See [Cloudflare](/reference/security/#cloudflare).
:::

## Sessions

- A session lasts 7 days.
- **Settings → Sessions → Sign out everywhere** ends every session, yours included.

## Appearance

**Settings → Appearance** picks the dashboard theme: Nebula (dark, default), Marathon, Nord, Synthwave, Terminal, Paper or Solarized (light). Each theme is shown as a small preview of the dashboard painted in it.