--- a/src/systemd/inactive.motd
+++ b/src/systemd/inactive.motd
@@ -1,2 +1,7 @@
 Activate the web console with: systemctl enable --now cockpit.socket
 
+Note: Cockpit disallows root login by default.
+To create a regular user and optionally enable 2FA run both:
+
+jeos-config user
+jeos-config otp
diff --git a/src/systemd/update-motd b/src/systemd/update-motd
index 67e0fb630..3c532d89f 100644
--- a/src/systemd/update-motd
+++ b/src/systemd/update-motd
@@ -18,7 +18,17 @@ ip=${3:-$(ip -o route get 255.0 2>/dev/null | sed -e 's/.*src \([^ ]*\) .*/\1/')
 # protocol from cmdline, then https
 protocol=${4:-https}
 
+mfa=""
+if ! grep -s pam_oath /etc/pam.d/cockpit; then
+  mfa="Note: Cockpit disallows root login by default.
+To create a regular user and optionally enable 2FA run both:
+
+jeos-config user
+jeos-config otp
+"
+fi
+
 hostname_url="${protocol}://${hostname}:${port}/"
 ip_url="${ip:+ or ${protocol}://${ip}:${port}/}"
 
-printf 'Web console: %s%s\n\n' "${hostname_url}" "${ip_url}"  > /run/cockpit/active.motd
+printf 'Web console: %s%s\n\n%b\n' "${hostname_url}" "${ip_url}" "${mfa}"  > /run/cockpit/active.motd