Users & Access Control¶
Roles¶
| Role | Rights |
|---|---|
| Administrator | Everything, including settings and user management |
| Operator | Day-to-day operations on permitted device groups |
| Read-only | View-only across permitted scopes |
Scope users by device group: a user only sees and operates the groups granted to them.
Authentication¶
- Local accounts with enforced password complexity, login lockout and session timeout (all configurable).
- LDAP integration for corporate directories.
- API tokens for automation against the REST API.
- The built-in admin must change its password on first login; sessions use HttpOnly/SameSite/Secure cookies with CSRF protection on all state-changing requests.
Credential security¶
Device passwords and LDAP/SNMP credentials are stored Fernet-encrypted at rest. Legacy plaintext values are migrated to ciphertext automatically on write. Optional strict SSH host-key verification pins device keys against ssh_known_hosts.
Audit¶
All logins and security-relevant actions are recorded; the dashboard surfaces recent logins and audit events. DCIM and change operations keep their own operation logs.