-
Notifications
You must be signed in to change notification settings - Fork 4
Email and Invitations
Three features depend on working SMTP: inviting users, self-service password reset, and emailed sign-in codes. None of them work until mail does.
Settings → Email. Fill in host, port, encryption, credentials and the from address, then use the test send. It delivers a real message and reports the provider's own error text on failure, which is almost always the fastest route to a fix.
Administrators are warned in the console while SMTP is unconfigured, because account recovery quietly depends on it — a user who forgets their password with no mail configured has no self-service path back in.
Your from address must be one the relay is permitted to send as. Most delivery failures are the relay rejecting the sender, not CortenDesk.
Invite by email instead of setting a password by hand. The recipient follows a link, chooses their own password, and lands with the account already configured.
Invitations expire after 48 hours by default. Expired and long-accepted invitations are cleaned up automatically by a scheduled job.
If you cannot send mail, create the user directly with a password instead — the invitation flow is a convenience, not the only way to add someone.
Users request a reset from the sign-in page. The link is single-use and valid for 60 minutes.
Completing a reset revokes that user's other sessions and RustDesk client tokens, so a reset cannot leave a stale session alive somewhere.
Self-service reset is unavailable when password sign-in is turned off in favour of SSO — in that case, passwords live with your identity provider.
Settings → Security → emailed sign-in verification, off by default.
With it on, signing in from a browser CortenDesk does not recognise triggers a one-time code by email, in addition to the password. The code is valid for 10 minutes.
A browser that passes is remembered for 30 days by default (trusted device days), after which it is challenged again. Expired trusted-device records are cleaned up by the same scheduled job as invitations.
This is not a replacement for two-factor authentication. It verifies control of the mailbox, which is weaker than a TOTP app — but it is useful where enrolling everyone in TOTP is impractical.
It can be turned on and off from the command line as well, which is the way back in if mail breaks while it is required:
php artisan cortendesk:email-verification offSee the command-line reference.
Email is optional on a user account. Someone with no address cannot be invited, cannot reset their own password, and cannot receive sign-in codes — an administrator has to set their password directly.
Add addresses before turning on anything that depends on them.