35 lines
1.7 KiB
Markdown
35 lines
1.7 KiB
Markdown
# Users
|
|
|
|
The users of the router's directory, without the [service accounts](service-accounts.md).
|
|
|
|
## Kinds of users
|
|
|
|
- **VPN user:** a first name, a last name, an e-mail address and a certificate; signs in to
|
|
OpenVPN, IKEv2 and WireGuard, and to the Manager.
|
|
- **Manager-only account:** a name, a password and an optional e-mail address; no certificate and
|
|
no VPN access.
|
|
|
|
## Columns
|
|
|
|
- **OTP:** whether the user is enrolled for one-time passwords (TOTP).
|
|
- **Passkeys:** how many passkeys the user signs in to the Manager with.
|
|
- **Console:** for a member of `admins`, the console login: off, the user's own POSIX account with
|
|
its uid, or the local account it runs as; marked as refused while the user is not enrolled for
|
|
TOTP. Root switches it on the router with `vpn-router-user console`.
|
|
|
|
## Actions
|
|
|
|
- **Add:** a VPN user, or with Manager access only a Manager-only account.
|
|
- **Edit:** the names and the e-mail address of a VPN user, the e-mail address of a Manager-only
|
|
account.
|
|
- **Password**, **Disable**, **Enable**, **Unlock** after failed logins, and **Remove**.
|
|
- **Profile:** downloads the OpenVPN client profile, while the router runs OpenVPN.
|
|
- **Apple VPN profile** (Apple icon): downloads a `.mobileconfig` that sets up the router's IKEv2
|
|
VPN on a Mac, iPhone or iPad, while the router runs IKEv2. The password you type protects the
|
|
user's key in the profile; the device asks for it when the profile is installed.
|
|
- **OTP:** enrols an authenticator app with a QR code, stored once a code of the app is entered,
|
|
or removes the enrolment.
|
|
- **Remove passkeys:** removes all the user's passkeys.
|
|
|
|
Five wrong passwords lock a user for 15 minutes; Unlock ends that sooner.
|