πŸ” Web Interface Authentication

Web interface credentials authenticate operators to the EdgeStream Hub management dashboard.

Note

Web dashboard accounts are separate from host-level server accounts. Holding a dashboard account does not grant SSH access, local terminal privileges, or root permissions.

First-Time Login (Default Admin Account)

When the appliance is first installed, a default administrative username and temporary setup password are created and stored on the server filesystem.

1. View the Temporary Password

Log in to the server via SSH and read the credentials file:

sudo cat /root/edgestream_credentials

2. Sign In to the Dashboard

  1. Open a web browser and go to https://<your-appliance-ip-or-hostname>.

  2. Enter the default username: edgestream@local.com.

  3. Paste the password from the credentials file.

Setup Recommendation: Create Your Personal Admin Account

To keep the system secure, avoid using the shared default account for routine tasks. Set up your personal administrator profile during initial configuration:

  1. In the left navigation menu, go to System β†’ Users.

  2. Click Create User.

  3. Fill in your name, email, and password, select the Administrator role, and save.

  4. Log out of the dashboard.

  5. Log back in using your new credentials.

  6. Go back to System β†’ Users, select the original edgestream@local.com account, and click Disable or Delete.

Important

Self-Deletion Safeguard: The dashboard does not allow you to delete or disable the account you are currently logged into.

Managing User Accounts

User administration is handled under System β†’ Users.

  • Adding Users: Click Create User, complete the fields, and select their access level.

  • Disabling an Account: If an operator leaves or no longer needs access, select their account and switch Enabled off. This blocks them from logging in immediately without deleting their audit history.

  • Deleting an Account: Click Delete next to an account to remove it permanently.

Allowing User Self-Registration

If you want new users to request their own accounts:

  1. Go to System β†’ Settings β†’ Advanced Settings.

  2. Find account_self_registration and set it to enabled (or disabled to close registration).

Note

Self-registration does not grant instant access. Newly registered accounts enter a Pending status. An administrator must open System β†’ Users, approve the request, and assign a role before the user can sign in.

Two-Factor Authentication (MFA / Authenticator App)

EdgeStream Hub works with standard mobile authenticator apps, such as Google Authenticator, Microsoft Authenticator, 1Password, or Authy.

Enabling MFA for an Account

  1. Go to System β†’ Users and click the user account you want to protect.

  2. Open the MFA tab.

  3. Open the authenticator app on your smartphone and scan the QR code shown on the screen.

  4. Type the 6-digit rolling code generated by your app into the verification box.

  5. Click Verify & Enable.

Future sign-ins for this account will require both the password and the current 6-digit code from the mobile app.

Emergency Access & Password Reset (CLI Tool)

If an administrator forgets their password or loses their phone with the authenticator app, an operator with SSH server access can resolve lockouts using the edgestream-users command-line utility.

1. View All Registered Users

Run the command without options to view all accounts and their statuses:

sudo /usr/sbin/edgestream-users

2. Reset an Account Password

To assign a new password to an existing account:

sudo /usr/sbin/edgestream-users <username> '<new_password>'

Example:

sudo /usr/sbin/edgestream-users admin@example.com 'NewSecurePass123!'

3. Remove a Lost MFA Requirement

If an administrator cannot generate a 6-digit code due to a lost or replaced phone, disable MFA for their username without changing their password:

sudo /usr/sbin/edgestream-users --remove-mfa <username>

Example:

sudo /usr/sbin/edgestream-users --remove-mfa admin@example.com

Once executed, the command displays a confirmation message. The user can log in using their normal password and re-link their authenticator app under System β†’ Users.