Admin users and roles
Manage the users who sign in to the web interface and the CLI (admin users) and what they may do (roles). Users who only connect over VPN are separate and are managed under VPN users (see Remote access VPN).
Only users with the Administrator role can manage admin users and roles. The menu items SYSTEM › Admin users and SYSTEM › Roles are shown only to administrators.
Changes here do not become pending changes. They take effect as soon as you press Save or Add, and they are not recorded in the configuration history.
Add an admin user
- Open SYSTEM › Admin users.
- Below the list, enter the Username (a-z, 0-9) and Password.
- Select a role. Read-only is preselected.
- To restrict where the user may sign in from, fill in Allowed login sources, e.g. 192.168.1.0/24.
- Press Add user.
Usernames use lowercase letters, digits, _ and -, up to 32 characters. The password must meet the Password requirements of the selected role.
Each user sets up two-factor authentication in their own Account settings (see Logging in to the web UI).
Change an admin user
- Click a row in the list. The User: name panel opens below.
- Change Role, Allowed login sources, Password or Status. Enter a password only if you want to change it.
- Press Save.
If the user is signed in, they are signed out and must sign in again with the new permissions.
| Field | Description |
|---|---|
| Role | Decides what the user can do, the password requirements and whether two-factor authentication is required. You cannot change your own role. |
| Two-factor | On means a code from an authenticator app is required at sign-in. |
| Allowed login sources | IP addresses or networks allowed to sign in, separated by commas. Leave blank to allow any. Applies to both the web interface and SSH. In the web interface it is also checked on every request after sign-in. |
| Password | New password. Use this to reset the password of another user who forgot it. |
| Status | Tick Disable to block sign-in without deleting the user. You cannot disable yourself. |
Reset two-factor authentication
If a user lost the device with their authenticator app, an administrator can reset it.
- Click the user's row in the list.
- Press Reset two-factor.
- The user signs in with the password only and sets up two-factor authentication again. If the role requires it, they are asked to set it up right after signing in.
Delete
Press Delete in the list. You cannot delete yourself.
The last administrator
If only one enabled user has the Administrator role, that user cannot be deleted, disabled or given another role. If no administrator can sign in, there is no other way to recover. We recommend having at least two administrators (see Troubleshooting).
Set up roles
A role sets None, View or Edit for each feature. Three roles are built in.
- Open SYSTEM › Roles and select a role in the list.
- In the table below, choose None, View or Edit for each feature.
- Set Two-factor, Password requirements and Session timeout.
- Press Save. Users with this role must sign in again.
To create a role, press Add role, enter a Role name (lowercase letters), a Display name (optional) and Copy from, then press Add. Then set its permissions in the table and press Save.
Built-in roles cannot be deleted. A role you created can be deleted with Delete when it has no members.
| Permission | Meaning |
|---|---|
| None | The page is hidden (also from the menu). |
| View | Read-only. Input fields are disabled. |
| Edit | Settings can be changed. |
Features and built-in roles
| Feature | Administrator | Operator | Read-only |
|---|---|---|---|
| Status (dashboard, devices, traffic, connections) | Edit | View | View |
| Interfaces and WAN | Edit | View | View |
| DHCP | Edit | Edit | View |
| DNS | Edit | Edit | View |
| Routing | Edit | View | View |
| Firewall | Edit | View | View |
| Port forwarding | Edit | Edit | View |
| VPN (users, groups, methods) | Edit | Edit | View |
| Logs | View | View | View |
| Diagnostics | Edit | Edit | None |
| System (hostname, time, reboot) | Edit | View | View |
| Backup | Edit | None | None |
| Changes (review, apply, confirm, history) | Edit | Edit | View |
- The permissions of the Administrator role cannot be changed. Only Two-factor, Password requirements and Session timeout can be changed.
- The permissions of Operator and Read-only can be changed.
- Logs can be at most View.
- A role with Edit on a feature but only View on Changes (review, apply, confirm, history) can save changes but not apply them. Another user who can apply does that.
- Managing admin users and roles cannot be granted to any role. Only the Administrator role can do it.
Other role settings
| Field | Description |
|---|---|
| Two-factor | Tick Require so that users without two-factor authentication must set it up right after signing in. They can do nothing else until they do. |
| Password requirements | Minimum length (8–128, default 10) and how many of uppercase, lowercase, digits and symbols are required (default 1). Passwords containing the username are not allowed. Applies to passwords set after the change. |
| Session timeout | Users are signed out after this much inactivity. 5–720 minutes, default 30. |
Sign-in protection
- Each failed sign-in to the web interface delays the response by 1 second.
- After 5 failures from the same source within 15 minutes, that source cannot sign in for 15 minutes (web interface and SSH failures are counted together).
- Even when active, users must sign in again 12 hours after signing in.