Configure a local user

Required configuration items

A username.
A password. The password must be at least eight characters long and must contain at least one uppercase letter, one lowercase letter, one number, and one special character. For security reasons, passwords are stored in hash form. There is no way to get or display passwords in clear-text form, although prior to saving the configuration, the password can be shown by clicking Reveal.
Note If the Primary Responder feature is enabled, the password must be at least 10 characters long and must contain at least one uppercase letter, one lowercase letter, one number, and one special character.
The authentication group or groups from which the user will inherit access rights. See Authentication groups for information about configuring groups.

Additional configuration items

An alias for the user. Because the username cannot contain any special characters, such as hyphens (-) or periods (.), an alias allows the user to log in using a name that contains special characters.
The number of unsuccessful login attempts before the user is locked out of the system.
The amount of time that the user is locked out of the system after the specified number of unsuccessful login attempts.
An optional public ssh key, to authenticate the user when using passwordless SSH login.
Two-factor authentication information for user login over SSH, telnet, and the serial console:
- The verification type for two-factor authentication: Either time-based or counter-based.
- The security key.
- Whether to allow passcode reuse (time based verification only).
- The passcode refresh interval (time based verification only).
- The valid code window size.
- The login limit.
- The login limit period.
- One-time use eight-digit emergency scratch codes.

To configure a local user:

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Authentication > Users.
In Add User, type a name for the user and click .

The user configuration window is displayed.

The user is enabled by default. To disable, toggle off Enable.
(Optional) For Username alias, type an alias for the user.
Because the name used to create the user and cannot contain special characters such as hyphens (-) or periods (.), an alias allows the user to log in using a name that contains special characters. For security purposes, if two users have the same alias, the alias will be disabled.
Enter a password for the user. The password must be at least eight characters long and must contain at least one uppercase letter, one lowercase letter, one number, and one special character.
Click to expand Login failure lockout.
The login failure lockout feature is enabled by default. To disable, toggle off Enable.
1. For Lockout tries, type the number of unsuccessful login attempts before the user is locked out of the device. The default is 5.
2. For Lockout duration, type the amount of time that the user is locked out after the number of unsuccessful login attempts defined in Lockout tries.
  Allowed values are any number of minutes, or seconds, and take the format number{m|s}.
  For example, to set Lockout duration to ten minutes, enter 10m or 600s.
  The minimum value is 1 second, and the maximum is 15 minutes. The default is 15 minutes.
Add groups for the user.
Groups define user access rights. See Authentication groups for information about configuring groups.
1. Click to expand Groups.
2. For Add Group, click .
3. For Group, select an appropriate group.
Note Every user must be configured with at least one group. You can add multiple groups to a user by clicking Add again and selecting the next group.
(Optional) Add SSH keys for the user to use passwordless SSH login:
1. Click SSH keys.
2. In Add SSH key, paste or type a public encryption key that this user can use for passwordless SSH login and click .
(Optional) Configure two-factor authentication for SSH, telnet, and serial console login:
1. Click Two-factor authentication.
2. Check Enable to enable two-factor authentication for this user.
3. Select the Verification type:
  - Time-based (TOTP): Time-based One-Time Password (TOTP) authentication uses the current time to generate a one-time password.
  - Counter-based (HOTP): HMAC-based One-Time Password (HOTP) uses a counter to validate a one-time password.
4. Generate a Secret key:
  1. Click ... next to the field label and select Generate secret key.
  2. Copy the secret key for use with an application or mobile device to generate passcodes.
5. For time-based verification only, select Disallow code reuse to prevent a code from being used more than once during the time that it is valid.
6. For time-based verification only, in Code refresh interval, type the amount of time that a code will remain valid.
  Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}. For example, to set Code refresh interval to ten minutes, enter 10m or 600s.
7. In Valid code window size, type the allowed number of concurrently valid codes. In cases where TOTP is being used, increasing the Valid code window size may be necessary when the clocks used by the server and client are not synchronized.
8. For Login limit, type the number of times that the user is allowed to attempt to log in during the Login limit period. Set Login limit to 0 to allow an unlimited number of login attempts during the Login limit period.
9. For Login limit period, type the amount of time that the user is allowed to attempt to log in.
  Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}. For example, to set Login limit period to ten minutes, enter 10m or 600s.
10. Scratch codes are emergency codes that may be used once, at any time. To add a scratch code:
  1. Click Scratch codes.
  2. For Add Code, click .
  3. For Code, enter the scratch code. The code must be eight digits, with a minimum of 10000000.
  4. Click  again to add additional scratch codes.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Add a user. For example, to create a user named new_user:

(config)> add auth user new_user
(config auth user new_user)>

The user is enabled by default. To disable the user, type:

(config auth user new_user)> enable false
(config auth user new_user)>

(Optional) Create a username alias for the user.
Because the name to create the user cannot contain special characters such as hyphens (-) or periods (.), an alias allows the user to log in using a name that contains special characters. For security purposes, if two users have the same alias, the alias will be disabled.
```
(config auth user new_user> username username_alias
(config auth user new_user)>
```
Set the user's password. The password must be at least eight characters long and must contain at least one uppercase letter, one lowercase letter, one number, and one special character.
```
(config auth user new_user> password pwd
(config auth user new_user)>
```
Configure login failure lockout settings:
The login failure lockout feature is enabled by default. To disable:
```
(config auth user new_user> lockout enable false
(config auth user new_user)>
```
1. Set the number of unsuccessful login attempts before the user is locked out of the device.
  where value is any integer. The minimum value is 1, and the default value is 5.
2. Set the amount of time that the user is locked out after the number of unsuccessful login attempts defined in lockout tries:
```
(config auth user new_user> lockout duration value
(config auth user new_user)>
```
  where value is any number of minutes, or seconds, and takes the format number{m|s}.
  For example, to set duration to ten minutes, enter either 10m or 600s:
```
(config auth user new_user)> lockout duration 600s
(config auth user new_user)> 
```
  The minimum value is 1 second, and the maximum is 15 minutes. The default is 15 minutes.
Add groups for the user.
Groups define user access rights. See Authentication groups for information about configuring groups.
1. Add a group to the user. For example, to add the admin group to the user:
```
(config auth user new_user> add group end admin
(config auth user new_user)>
```
  Note Every user must be configured with at least one group.
2. (Optional) Add additional groups by repeating the add group command:
```
(config auth user new_user> add group end serial
(config auth user new_user)>
```
To remove a group from a user:
1. Use the show command to determine the index number of the group to be deleted:
```
(config auth user new_user> show group
0 admin
1 serial
(config auth user new_user> 
```
2. Type the following:
```
(config auth user new_user)> del group n
(config auth user new_user)>
```
  Where n is index number of the authentication method to be deleted. For example, to delete the serial group as displayed by the example show command, above:
```
(config auth user new_user)> del group 1
(config auth user new_user)>
```
(Optional) Add SSH keys for the user to use passwordless SSH login:
1. Change to the user's ssh_key node:
```
(config auth user new_user)> ssh_key
(config auth user new_user ssh_key)>
```
2. Add the key by using the ssh_key command and pasting or typing a public encryption key that this user can use for passwordless SSH login:
```
(config auth user new_user ssh_key)> ssh_key key
(config auth user new_user ssh_key)>
```
(Optional) Configure two-factor authentication for SSH, telnet, and serial console login:
1. Change to the user's two-factor authentication node:
```
(config auth user new_user)> 2fa
(config auth user new_user 2fa)>
```
2. Enable two-factor authentication for this user:
```
(config auth user new_user 2fa)> enable true
(config auth user new_user 2fa)>
```
3. Configure the verification type. Allowed values are:
  - totp: Time-based One-Time Password (TOTP) authentication uses the current time to generate a one-time password.
  - hotp: HMAC-based One-Time Password (HOTP) uses a counter to validate a one-time password.
  The default value is totp.
```
(config auth user new_user 2fa)> type totp
(config auth user new_user 2fa)>
```
4. Add a secret key:
```
(config auth user new_user 2fa)> secret key
(config auth user new_user 2fa)>
```
  This key should be used by an application or mobile device to generate passcodes.
5. For time-based verification only, enable disallow_reuse to prevent a code from being used more than once during the time that it is valid.
```
(config auth user new_user 2fa)> disallow_reuse true
(config auth user new_user 2fa)>
```
6. For time-based verification only, configure the code refresh interval. This is the amount of time that a code will remain valid.
```
(config auth user new_user 2fa)> refresh_interval value
(config auth user new_user 2fa)>
```
  where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.
  For example, to set refresh_interval to ten minutes, enter either 10m or 600s:
```
(config auth user name 2fa)> refresh_interval 600s
(config auth user name 2fa)> 
```
  The default is 30s.
7. Configure the valid code window size. This represents the allowed number of concurrently valid codes. In cases where TOTP is being used, increasing the valid code window size may be necessary when the clocks used by the server and client are not synchronized.
```
(config auth user new_user 2fa)> window_size 3
(config auth user new_user 2fa)>
```
8. Configure the login limit. This represents the number of times that the user is allowed to attempt to log in during the Login limit period. Set to 0 to allow an unlimited number of login attempts during the Login limit period
```
(config auth user new_user 2fa)> login_limit 3
(config auth user new_user 2fa)>
```
9. Configure the login limit period. This is the amount of time that the user is allowed to attempt to log in.
```
(config auth user new_user 2fa)> login_limit_period value
(config auth user new_user 2fa)>
```
  where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.
  For example, to set login_limit_period to ten minutes, enter either 10m or 600s:
```
(config auth user name 2fa)> login_limit_period 600s
(config auth user name 2fa)> 
```
  The default is 30s.
10. Scratch codes are emergency codes that may be used once, at any time. To add a scratch code:
  1. Change to the user's scratch code node:
    (config auth user new_user 2fa)> scratch_code (config auth user new_user 2fa scratch_code)>
  2. Add a scratch code:
    (config auth user new_user 2fa scratch_code)> add end code (config auth user new_user 2fa scratch_code)>
    Where code is an digit number, with a minimum of 10000000.
  3. To add additional scratch codes, use the add end code command again.

Save the configuration and apply the change.

(config auth user new 2fa scratch_code)> save
Configuration saved.
>

Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.