# Users

The users of the router's directory, without the [service accounts](service-accounts.md).

## Kinds of users

- **VPN user:** a first name, a last name, an e-mail address and a certificate; signs in to
  OpenVPN, IKEv2 and WireGuard, and to the Manager.
- **Manager-only account:** a name, a password and an optional e-mail address; no certificate and
  no VPN access.

## Columns

- **OTP:** whether the user is enrolled for one-time passwords (TOTP).
- **Passkeys:** how many passkeys the user signs in to the Manager with.
- **Console:** for a member of `admins`, the console login: off, the user's own POSIX account with
  its uid, or the local account it runs as; marked as refused while the user is not enrolled for
  TOTP. Root switches it on the router with `vpn-router-user console`.

## Actions

- **Add:** a VPN user, or with Manager access only a Manager-only account.
- **Edit:** the names and the e-mail address of a VPN user, the e-mail address of a Manager-only
  account.
- **Password**, **Disable**, **Enable**, **Unlock** after failed logins, and **Remove**.
- **Profile:** downloads the OpenVPN client profile, while the router runs OpenVPN.
- **Apple VPN profile** (Apple icon): downloads a `.mobileconfig` that sets up the router's IKEv2
  VPN on a Mac, iPhone or iPad, while the router runs IKEv2. The password you type protects the
  user's key in the profile; the device asks for it when the profile is installed.
- **OTP:** enrols an authenticator app with a QR code, stored once a code of the app is entered,
  or removes the enrolment.
- **Remove passkeys:** removes all the user's passkeys.

Five wrong passwords lock a user for 15 minutes; Unlock ends that sooner.