accounts.conf

Change the passwords of the built-in accounts, add your own accounts or disable accounts for logging in to the application.

  3 minute read  

accounts.conf sets who can log in to the application from Motorcortex Desk, a dashboard or your own program, with which password, and what each account may change. It only matters when login is on.

/etc/motorcortex/config/
└── accounts.conf

When the file is read

The application reads accounts.conf at start-up, when both of these hold in the Server block of config.json:

  • Login is not "disable": login is on.
  • Accounts names the file. A relative path starts in the folder of config.json.
"Server": {
  "Default": {
    "URL": "wss://*:5568:5567",
    "Login": "enable",
    "Accounts": "accounts.conf",
    "Certificate": "/etc/ssl/certs/motorcortex.pem"
  }
}

The standard robot configuration has "Login": "disable", so every client that can reach the controller connects with administrator rights, without a password.

How the accounts are built

The application starts with three built-in accounts. accounts.conf is then read line by line, on top of them: a line can change an account, add one or disable one.

Built into the application fixed default passwords administratorgroup 3 operatorgroup 7 monitorgroup 15 accounts.conf read line by line, on top operator:7 $6$… service:3 $6$… monitor disable Accounts you can log in with after start-up administratorgroup 3built-in password operatorgroup 7new password monitorgroup 15disabled servicegroup 3added

When login is on but the file cannot be opened, only the built-in accounts exist, and the log shows Failed to initialize user login, using default system login.

The format

Each line is one account: a name with a groupThe group of an account sets what it may do. administrator may change all parameters except system-level ones. operator may read everything and write inputs only. monitor may read everything and write nothing. number, a space, and the password hash.

name:group password_hash
Part What it is
name The login name. An existing name changes that account; a new name adds one.
group 3 for administrator, 7 for operator, 15 for monitor. Do not use 1: that is the system group, for the application itself. Any other number makes the account a monitor. Without :group the line can only change an existing account, which keeps its group.
password_hash The password as a SHA-512 crypt hash, which starts with $6$. The word disable instead of a hash disables the account.

Create a hash in any terminal with OpenSSL; replace MyNewPassword with the password:

openssl passwd -6 MyNewPassword

This file gives the built-in operator account a new password, adds an administrator account service, and disables monitor. Both hashes are of the password example; make your own.

operator:7 $6$Xq3vLr8ePz0NmT2a$nrc/jtZhOt30RicNqscDhScIr6Jojl0XqZ4jnTWapEWgB0vurMp4QQNgpb1fKlqbu/8VFtfW7O4aksyJ0ktQg1
service:3 $6$9hWc4KdYs1BfUe7J$a9t5pEHvaw6Flo57xWMUiwnGq1JXt1AZ7i/Rij46peRGHUVakTVuhdeQypduQiJT6uptJVRK/NNcOZNgeMhR90
monitor disable

A line with an empty password, or a new name without a group, is skipped and reported in the log. The file takes effect at the next start of the application.

For logging in to the controller itself, rather than the application, see User access.