Security
Security gives non-root users self-service controls for password, API key, 2FA, and separate panel/API source rules, while root security lives in Cluster and Local Settings.
Where to find it: SDM sidebar > Security for admin/operator/viewer; root uses the security tabs in Cluster Settings and Local Settings.
Available to: Every authenticated user for their own account; root for server-wide controls and user resets.
What this page does
The page separates human browser access from automation. Password and 2FA protect panel sign-in; the API key identifies an external client; Panel Access and API Access IP lists restrict different entry points. Changing one does not silently configure the other.
Before you start
Have the current password for self-service changes, the authenticator for 2FA, and a stable source address before adding an allowlist. Keep the current session open while testing new restrictions.
User controls
- Change password: current password, new password, repeat; 12–72 bytes.
- Reset API key: immediately replaces the old key; update integrations securely.
- 2FA: bootstrap a secret/QR, verify a six-digit code to enable, or disable through the guarded flow.
- API Access: add/remove IP or CIDR plus optional comment for public API calls.
- Panel Access: separate IP/CIDR list for browser login.
Root controls
Local Settings contains root password, daily OS auto-update, kernel exclusion, dry-run/update job, SSH port, and AllowUsers. Cluster Settings contains root 2FA, root panel IP access, login rate-limit settings, current automatic/manual blocks, manual block, and unblock. Users lets root rotate another account's key/password, suspend it, disable 2FA, and maintain both source lists.
Controls and fields
| Control, Field, Or Section | What It Does | What It Affects | Recommended Usage |
|---|---|---|---|
| Change Password | Changes the signed-in user password in self-service scope or the root password in root scope. | Updates authentication credentials immediately. | Use strong generated passwords and verify secure storage before saving. |
| Current password | Current user password required for self-service password change. | Prevents unauthorized password changes from an unattended session. | If unknown, use administrator reset rather than guessing. |
| New password / repeat password | Replacement password and confirmation. | Changes account login secret after validation. | Use unique values and avoid reuse across customers. |
| API key field | Displays the current user API key masked by default. | API key authenticates external integrations for that user. | Reveal only when copying into an approved secret store. |
| Show/Hide API key | Toggles API key visibility. | No backend change, but exposes a secret in the browser. | Use briefly and clear screen-sharing risk first. |
| Copy API key | Copies the API key to clipboard. | No backend change. | Paste only into a secure vault or integration configuration. |
| Generate New API Key | Regenerates the current user API key after confirmation. | Immediately invalidates the old key. | Coordinate with every integration that uses the key before rotating. |
| API IP Access Control | Defines trusted IP/CIDR sources for API key usage. | If rules exist, API calls from other sources are denied. | Add automation server addresses before enabling strict API restrictions. |
| Panel IP Access Control | Defines trusted IP/CIDR sources for browser login. | If rules exist, login from other sources is denied. | Include admin VPN/office ranges and maintain recovery access. |
| Generate QR Code | Creates 2FA enrollment data for the current user or root scope. | Prepares a new authenticator enrollment. | Generate only when ready to scan and verify. |
| Secret / QR / OTP URL | Authenticator enrollment values. | Used by the authenticator app to generate one-time codes. | Treat the secret like a password; do not store it in tickets. |
| Verification code | Six-digit code from authenticator app. | Confirms enrollment before 2FA becomes active. | If it fails, check phone time sync and regenerate the QR code. |
| Enable 2FA | Activates 2FA after code validation. | Adds a required second factor to login. | Enable for administrator accounts and API-sensitive users. |
| Disable 2FA | Turns off the configured 2FA secret. | Removes the second-factor requirement for that scope. | Use only for verified recovery, then re-enable. |
| Daily Auto Update / Exclude Kernel / Save Auto Update | Controls root OS update automation from the security/local scope. | Changes package maintenance behavior for the node. | Exclude kernels when reboots require strict windows. |
| Dry Run / Update System / Refresh Status | Runs or monitors one-off system update work. | Can apply package updates when dry run is disabled. | Run dry run first and review log tail before applying. |
| SSH Port / AllowUsers | Controls shell access port and allowed login patterns. | Can block or permit SSH access. | Keep an active tested recovery path before saving restrictive SSH changes. |
| Rate limit controls | Set max failures, failure window, automatic block duration, manual block, and unblock behavior. | Protect login from brute-force and suspicious sources. | Tune carefully to prevent support lockouts. |
Safety notes
- Lockout controls can block legitimate access if misconfigured. Keep a tested recovery path for root access.
How to use it
- Change one security layer at a time.
- For 2FA, scan/bootstrap and verify a current code before considering it enabled.
- For IP rules, add the real current source first and test from a second session.
- For API-key reset, replace the key in every approved integration and run ping.
- Review Audit for the security action and revoke access immediately if compromise is suspected.
Result and next check
The panel and API accept only the intended credentials, factors, and sources. A valid key still cannot cross role, permission, or zone ownership boundaries.
Theme color