# 🔐 Web Interface Authentication

Web interface credentials authenticate operators to the EdgeStream Hub management dashboard.

```{note}
Web dashboard accounts are separate from host-level server accounts. Holding a dashboard account does **not** grant SSH access, local terminal privileges, or root permissions.

```

---

## First-Time Login (Default Admin Account)

When the appliance is first installed, a default administrative username and temporary setup password are created and stored on the server filesystem.

### 1. View the Temporary Password

Log in to the server via SSH and read the credentials file:

```bash
sudo cat /root/edgestream_credentials

```

### 2. Sign In to the Dashboard

1. Open a web browser and go to `https://<your-appliance-ip-or-hostname>`.
2. Enter the default username: `edgestream@local.com`.
3. Paste the password from the credentials file.

---

## Setup Recommendation: Create Your Personal Admin Account

To keep the system secure, avoid using the shared default account for routine tasks. Set up your personal administrator profile during initial configuration:

1. In the left navigation menu, go to **System → Users**.
2. Click **Create User**.
3. Fill in your name, email, and password, select the **Administrator** role, and save.
4. Log out of the dashboard.
5. Log back in using your new credentials.
6. Go back to **System → Users**, select the original `edgestream@local.com` account, and click **Disable** or **Delete**.

```{important}
**Self-Deletion Safeguard:** The dashboard does not allow you to delete or disable the account you are currently logged into.

```

---

## Managing User Accounts

User administration is handled under **System → Users**.

* **Adding Users:** Click **Create User**, complete the fields, and select their access level.
* **Disabling an Account:** If an operator leaves or no longer needs access, select their account and switch **Enabled** off. This blocks them from logging in immediately without deleting their audit history.
* **Deleting an Account:** Click **Delete** next to an account to remove it permanently.

### Allowing User Self-Registration

If you want new users to request their own accounts:

1. Go to **System → Settings → Advanced Settings**.
2. Find `account_self_registration` and set it to **enabled** (or **disabled** to close registration).

```{note}
Self-registration does **not** grant instant access. Newly registered accounts enter a **Pending** status. An administrator must open **System → Users**, approve the request, and assign a role before the user can sign in.

```

---

## Two-Factor Authentication (MFA / Authenticator App)

EdgeStream Hub works with standard mobile authenticator apps, such as Google Authenticator, Microsoft Authenticator, 1Password, or Authy.

### Enabling MFA for an Account

1. Go to **System → Users** and click the user account you want to protect.
2. Open the **MFA** tab.
3. Open the authenticator app on your smartphone and scan the QR code shown on the screen.
4. Type the 6-digit rolling code generated by your app into the verification box.
5. Click **Verify & Enable**.

Future sign-ins for this account will require both the password and the current 6-digit code from the mobile app.

---

## Emergency Access & Password Reset (CLI Tool)

If an administrator forgets their password or loses their phone with the authenticator app, an operator with SSH server access can resolve lockouts using the `edgestream-users` command-line utility.

### 1. View All Registered Users

Run the command without options to view all accounts and their statuses:

```bash
sudo /usr/sbin/edgestream-users

```

### 2. Reset an Account Password

To assign a new password to an existing account:

```bash
sudo /usr/sbin/edgestream-users <username> '<new_password>'

```

*Example:*

```bash
sudo /usr/sbin/edgestream-users admin@example.com 'NewSecurePass123!'

```

### 3. Remove a Lost MFA Requirement

If an administrator cannot generate a 6-digit code due to a lost or replaced phone, disable MFA for their username without changing their password:

```bash
sudo /usr/sbin/edgestream-users --remove-mfa <username>

```

*Example:*

```bash
sudo /usr/sbin/edgestream-users --remove-mfa admin@example.com

```

Once executed, the command displays a confirmation message. The user can log in using their normal password and re-link their authenticator app under **System → Users**.