User accounts

Set and recover the local administrator password on a device.

Each device has a local administrator account used for console and SSH access. This page explains how its password is set and stored, and how to recover access if the password is lost.

The administrator account

The administrator account (admin) has the privileges needed to operate the device locally. It is the account you use on the console, and over SSH if you enable password authentication.

Where the initial password comes from

This depends on how the device was installed, and the difference matters: one of these paths gives you a device that is reachable with a credential you did not choose.

How the device was installed	Initial administrator password
SPEKTRA Edge appliance, shipped with the OS installed	The hardware serial number
Image downloaded from the dashboard	The password you set when you downloaded it
Vanilla image file, customized with `cuttle`	The password you set with `cuttle os edit` before writing the media
Droplet agent installed from a `.deb`	Not managed by SPEKTRA Edge

SPEKTRA Edge appliances

An appliance arrives with the OS already installed, so it needs a credential you can use on first boot. That credential is the hardware serial number. It works only while no administrator password has been set: once you set one, the serial number stops being accepted.

Change the appliance password on first login

A serial number is not a secret. It is usually printed on the chassis or its packaging, and the platform also reports it in the device’s hardware inventory. Anyone who can read the label — or who has access to your device list — can sign in to an appliance whose password has not been changed yet.

Set an administrator password as the first thing you do, and certainly before the device is placed on an untrusted network or has SSH password authentication enabled. Sign in with the serial number and run:

sudo change-password

Because no password is set yet, this asks only for the new one. From then on the serial number is refused.

Images downloaded from the dashboard

When you download an install image from the dashboard you supply the administrator password at that point, and it applies to every device built from that image.

Vanilla image files

A vanilla image file downloaded directly has no administrator password in it. You configure one with cuttle while customizing the image, before writing the installation media:

sudo -E cuttle os edit \
  --image-file spektra-edge_generic-amd64_$VERSION.raw \
  --password $PASSWORD

The device then has the password you supplied, and there is no default credential at any point. See Create an install image for the surrounding workflow.

Setting a password is not enforced

--password is optional. If you omit it, the media is written with no administrator password and there is no value that will let you in on the console — which locks you out locally instead of leaving you exposed. Supply a password unless you intend to rely solely on SSH key authentication.

Devices running the droplet agent from a `.deb`

Installing the agent onto a machine you already run does not create or manage local accounts, and does not change how that machine authenticates logins. Its existing users, passwords, and SSH configuration continue to apply, and nothing on this page does. See Install the droplet agent.

How the password is stored

The password must be non-empty. It is stored only as a salted hash on the device’s configuration storage — the plaintext password is never written to the device. When the configuration area is encrypted, the stored hash is protected at rest as well.

Changing the password on a running device

On a device you can still sign in to, change the password from its console:

sudo change-password

It prompts for the current password before accepting a new one, so it changes a password; it does not recover a lost one. The only exception is a device that has no password set yet, such as a new appliance, where it asks only for the new password.

Resetting a lost password

Because the password is stored on the device’s configuration storage rather than inside the read-only system image, it can be reset without reinstalling. Every route needs physical access to the storage, though: a lost password cannot be reset over the network.

Point cuttle at the disk holding the configuration partition to write a new password to it directly:

sudo cuttle os change-password $PASSWORD --out-device /dev/sdX

Re-imaging the device is the other option, and the one to choose if you also want to reset the rest of its configuration.

On a SPEKTRA Edge appliance the configuration partition is inside the unit, so resetting a lost password means either removing the disk to run the command above against it or re-imaging. Neither the serial number nor the platform can recover it: the serial number is refused once any password is set, and there is no remote password reset.

If the device is still reachable through the platform, you can continue to operate it via remote access while you arrange physical access — managing a device does not depend on its local administrator password.

Recommendations

On an appliance, set an administrator password before anything else. Until you do, the serial number is a working credential.
Use a strong, unique administrator password per fleet or per device.
Enable disk encryption so the stored password hash and all configuration are protected at rest.
Prefer SSH key or certificate authentication over passwords for routine access. If you do enable SSH password authentication, make sure every device in scope has a password you chose first.

SSH access — preferred over password login.
Device setup & provisioning — where the administrator password is first set.
Security — the rest of this section.
Create an install image — setting the initial administrator password.