Is Your UniFi System Showing Unauthorised Access?
Discovering that someone may have accessed your UniFi cameras or network without your permission can be unsettling. Your security system is there to protect you, and any breach of that trust needs immediate attention. Whether you've received an explicit "unauthorized access" notification or you've noticed strange activity, this guide will walk you through the essential steps to troubleshoot the issue and re-secure your UniFi system.
This guide will help you diagnose the problem, from checking user permissions to strengthening your overall network security. We'll provide clear, actionable solutions to restore your peace of mind.
Common Symptoms of Unauthorised Access
If you suspect a security issue, you might be experiencing one or more of the following signs. Recognising these symptoms is the first step toward resolving the problem.
- Unexpected Notifications: You receive alerts for logins or configuration changes that you did not make.
- Camera Reconfigurations: You notice camera settings, such as recording schedules or motion zones, have been altered without your knowledge.
- New or Unknown Devices: Unfamiliar client devices appear in your UniFi Network device list.
- Failed Login Attempts: Your system logs show multiple failed login attempts from unknown IP addresses.
- Added User Accounts: You discover new administrator or user accounts in your UniFi OS settings that you didn't create.
- Unexplained Network Traffic: You observe unusual spikes in data usage on your network, which could indicate data exfiltration.
- Locked Out of Your Account: In a worst-case scenario, you may find that your own password no longer works, indicating it has been changed.
Step-by-Step Troubleshooting Guide
Follow these steps methodically to identify the source of the unauthorized access and secure your UniFi system against future threats.
1. Immediately Change Your Passwords
Your first and most critical action is to change the password for all administrator accounts on your UniFi OS Console (e.g., Cloud Key, UDM Pro).
- Navigate to your UniFi OS dashboard.
- Go to the Users section.
- Select each user, especially those with Administrator or Super Administrator roles.
- Choose to edit the user and set a new, strong, and unique password. A good password should be more than 12 characters and include a mix of uppercase letters, lowercase letters, numbers, and symbols.
2. Enable Two-Factor Authentication (2FA)
2FA is one of the most effective ways to prevent unauthorized access, even if someone has managed to steal your password.
- In your UniFi OS dashboard, go to your account settings.
- Find the Security or Two-Factor Authentication section.
- Follow the on-screen instructions to enable 2FA using an authenticator app like Google Authenticator or Authy. This will require a time-based code from your phone for every login.
3. Review Access Logs and User Permissions
Carefully examine who has access to your system and what they've been doing.
- Check Login History: In the UniFi Network application, review the System Log for all successful and failed login attempts. Note any IP addresses that you do not recognise.
- Audit User Accounts: In the UniFi OS Users section, review every single account. If you see any users you don't recognise, disable or delete them immediately.
- Principle of Least Privilege: Ensure that users only have the permissions they absolutely need. For example, a family member who only needs to view camera feeds should have a "View Only" role, not an "Administrator" role.
4. Secure Your Wider Network
The security of your UniFi system depends on the security of your entire network.
- Wi-Fi Password: Ensure your Wi-Fi networks are protected with a strong WPA2 or WPA3 password. If you suspect a breach, change your Wi-Fi password immediately.
- Firmware Updates: Regularly check for and install firmware updates for your UniFi OS Console and all connected devices (cameras, switches, access points). These updates often contain critical security patches.
- Restrict Remote Access: If you do not need remote access, consider disabling it. If you do, ensure it's restricted by IP address where possible, allowing connections only from trusted locations.
By following these steps, you can effectively troubleshoot unauthorised access alerts and significantly strengthen the security of your UniFi ecosystem. Regular security audits are a good practice to ensure your system remains secure over time.