pikvm/docs/auth.md

Authentication

PiKVM comes with the following default passwords:

• Linux admin (SSH, console, etc.): user root, password root.
• PiKVM Web Interface, API, VNC...: user admin, password admin, no 2FA code.

These are two separate entities with independent accounts. To change passwords, you will need to use the terminal access via SSH or Web Terminal. If you are using the Web Terminal, use the su - command to get root access (enter the root user password).

Changing the Linux password

# rw
# passwd root
# ro

Changing the KVM password

# rw
# kvmd-htpasswd set admin
# ro

Please note that admin is the default user. It is possible to create several different users with different passwords to access the Web UI, but keep in mind that they all have the same rights:

# kvmd-htpasswd set <user> # Sets a new user with password
# kvmd-htpasswd del <user> # Removes/deletes a user

Two-factor authentication

This is a new method of strengthening the protection of PiKVM, available since KVM >= 3.196. It is strongly recommended to enable it if you expose the PiKVM in the big and scary Internet.

!!! warning Using 2FA eliminates the possibility of using IPMI and VNC with vncauth (not used by default). It also slightly affects the use of API and regular VNC with user/password, read below.

Steb-by step to enable 2FA:

1. Update OS: rw && pacman -Syu && reboot.

2. Make sure that NTP is running otherwise you will not be able to access (timedatectl command). The timezone doesn't matter.

3. Install Google Authenticator app to your phone (iOS, Android). It will generate one-time access codes.

4. Create a secret for one-time codes on PiKVM:

   rw
   kvmd-totp init
   ro
   

5. Run Google Authenticator and scan the QR code.

6. Now, on the PiKVM login page, you will need to add 6 digits to the 2FA code field.

Now all Web UI users will be required to enter a one-time password. In other words, the secret is the same for all users.

!!! note With 2FA for API or VNC authentication, you will need to add the one-time code to the password without spaces. That is, if the password is foobar and the code is 123456, then you need to use foobar123456 as the password.

To view the current QR code of the secret use kvmd-totp show.

To disable 2FA, use kvmd-totp del.