First sign-in

A new Warda has one account, admin, with the default password Ward@-MM-YYYY, where MM-YYYY is the month and year of its version (the date of the commit the version is built from): Ward@-09-2026 for a version of September 2026. warda setup-info prints it, and the release notes give it too.

1. Open http://warda (or http://ADDRESS-OF-THE-MACHINE) from a computer of the network. The certificate is self-signed: accept it once.
2. Sign in as admin with the default password, within 60 minutes after Warda starts. Past that, restart Warda (unplug and plug back a Raspberry Pi) to open the window again. Once installed, the default password never works again.
3. Read the summary of the terms of use and accept them (the full text is at https://warda-dns.com/<language>/terms/); the anonymous daily statistics are shown on the same step, on, and can be unchecked.
4. Choose a new password for admin, then create your own account. Keep the admin password somewhere safe: it is the emergency account, and each of its sign-ins is shown on the dashboard for 7 days.

Each adult of the household gets their own access to Warda from their card in Household → People (Give an access: user name, member or administrator, temporary password), or is proposed an existing one; the adult accepts the link from My account. Administration → Access to Warda lists every access with its person; admin belongs to nobody.

Forgotten password: another adult gives a new temporary one from the Access to Warda page, or sudo warda reset-password NAME prints one; it is changed at the next sign-in. Phone and recovery codes lost as well: sudo warda reset-password -mfa NAME also turns the second step off.

Passwords must have at least 12 characters with a lower-case letter, a capital, a digit and a special character. Warda refuses common passwords, sequences, passwords containing the account name, warda or the default password, the last 5 passwords of the account, and, unless WARDA_PASSWORD_BREACH_CHECK=false, passwords found in known breaches (Have I Been Pwned; only the first 5 characters of the SHA-1 hash leave the machine, and the check is skipped offline). Characters that are not on every keyboard are accepted with a warning. Passwords are hashed with Argon2id. After 5 wrong passwords for a name from one address, that address waits 1 minute, then twice as long after each new failure, up to 1 hour; the owner signing in from another device is not blocked. One address may fail 20 times in 10 minutes, whatever the names. An IPv6 address is also counted with its /64, at 4 times these limits (a device that changes address gets no new tries). After 30 failures on a name, whatever the addresses, its attempts are spaced by 10 seconds (HTTP 429 in between): slowed down, never locked, so the owner still gets in. These counters live in memory: restarting Warda clears them. Each account can add a second step (TOTP application, 10 recovery codes); 5 wrong codes lock it the same way. Changes to accounts (creation, removal, temporary password, second step turned off) ask the password of the adult who makes them.