Access Local UI

Local UI allows you to manage Edge hosts in your network locally, upload content such as images and packs, and create Edge clusters without connections to a Palette installation.

This page guides you through how access the console, and log in, and manage your username and password.

Log in to Local UI

Prerequisites

• An Edge host installed with Edge Installer 4.3 or later.

• Network access to the Edge host's port where Local UI is exposed. The default port is 5080.

• Credentials to log in to Local UI. Any OS user can be used to log into Local UI. If the password is expired, you can still log in and change it inline. Refer to Change an Expired Password at Login for more information.

Instructions

1. Ensure the Edge host is powered on.

2. In your browser, go to https://HOST_IP:5080. Replace HOST_IP with the IP address of your Edge host. If you have access to the Edge host terminal, the address of Local UI console is displayed on the terminal screen. If you have changed the default port of the console, replace 5080 with Local UI port.

3. You will be prompted to log in. Enter your username and password to log in.

Login Security Behavior

In case of several consecutive unsuccessful login attempts, Local UI enforces a short delay before you can attempt to log in again. The delay starts at one second and doubles with each subsequent failed attempt. By default, the delay mechanism begins after three unsuccessful login attempts.

If you reach the maximum number of consecutive unsuccessful login attempts, Local UI temporarily blocks access for your user. The lockout occurs when the number of failed attempts reaches the sum of the delay threshold and the maximum failed attempts setting. By default, this lockout occurs after eight consecutive failed attempts (three before the delay begins, and then five more) and lasts for 15 minutes. Local UI restores access automatically when the lockout period ends.

You can customize the default values in the user-data file for Edge hosts built with Palette agent version 4.7.16 or later. For example, to block access after three consecutive failed attempts, set stylus.localUI.login.attemptsBeforeExponentialDelayStarts to 1 and stylus.localUI.login.maxFailedAttemptsBeforeLockout to 2. Set each value to 1 or greater, because the Palette agent replaces a value of 0 or less with the default. For more information, refer to the stylus.localUI.login parameters description in the Edge Installer Configuration Reference.

Change an Expired Password at Login

If your OS password is expired when you log in, Local UI detects the expired password instead of reporting incorrect credentials, and prompts you to change it without leaving the login page. This applies whether an administrator expired the password, for example with passwd --expire or chage --lastday 0, or a Pluggable Authentication Modules (PAM) policy expired it after the number of days set in PASS_MAX_DAYS. Both cases look the same to you at login.

Expired-password detection at Local UI login requires Palette agent version 4.10.4 or later. On earlier agent versions, Local UI reports an expired password as a generic login failure, and you must recover through SSH or the Palette TUI console.

To change your password when Local UI detects that it is expired, follow these steps.

1. At https://HOST_IP:5080, enter your username and expired password, then click Sign in.

2. Local UI reports that your password has expired and displays a password change form.

3. In the Old Password field, enter your expired password.

4. In the New Password and Confirm Password fields, enter a new password. If you configured a PAM policy, the new password must comply with it. Otherwise, Local UI returns an error.

5. Click Update.

After a successful change, Local UI returns to the login screen. Log in with your new password to reach the Edge management console.

info

If Local UI reports that your account is locked or has expired and directs you to contact your system administrator, the account itself is locked or expired rather than the password. This state is distinct from an expired password and cannot be resolved from the login screen. Local UI also locks an account after repeated failed login attempts. Refer to Login Security Behavior for details.

Validate

A successful login directs you to the Edge management console. Displayed is an overview of your Edge host.

Log out of Local UI

Prerequisites

• You are logged in to Local UI.

Instructions

1. In your browser, go to https://HOST_IP:5080. Replace HOST_IP with the IP address of your Edge host. If you have access to the Edge host terminal, the address of Local UI console is displayed on the terminal screen. If you have changed the default port of the console, replace 5080 with Local UI port.

2. From Local UI, navigate to the top right User Menu.

3. Click Sign out.

Validate

A successful sign-out takes you back to the login page. You need to enter your credentials to log in again.

Change User Password

You can change the password of an OS user through Local UI, through the terminal, or through the Palette API. The TUI prompts for a password change when the password is expired and is not intended as the primary method for updating passwords. Local UI also prompts for a change when the password is expired at login. Refer to Change an Expired Password at Login.

info

Password quality rules are enforced by Pluggable Authentication Modules (PAM) on the Edge host and are configured when the image is built. Local UI, the TUI, and the Palette API all change passwords as root, and PAM exempts root from password quality checks by default. Unless the image sets the PAM enforce_for_root option, a password that does not meet your policy is accepted through these interfaces without a visible warning, even though the same password is rejected when a non-root user runs passwd. Refer to Build Edge Artifacts for how to configure PAM policies.

warning

If you populated the stylus.site.users[*].passwordExpiry field value in the user data, change the password from Local UI or when TUI prompts you to change it. Otherwise, the expiry date is not cleared.

Prerequisites

• Network access to the Edge host's port where Local UI is exposed. Default is port 5080.

• Credentials to log in to Local UI. Any OS user can be used to log into Local UI.

• Depending on how you want to change the password, additional prerequisites are required.

  Local UI

  • Through Local UI: The stylus.disablePasswordUpdate parameter is set to false in the installer configuration user data. The default value of the parameter is false. For more information, refer to Installer Reference.

  Terminal

  • None.

  API

  • Through the API: curl or another similar tool you can use to make HTTP requests is installed on the machine you use to access the Edge Management API.

info

If the ability to change the password is disabled from Local UI, you can still log in to the terminal or use the Palette API to update the password.

Instructions

Local UI

1. Log in to Local UI.

2. From Local UI, navigate to the top right User Menu.

3. Click Update password.

4. Provide your existing credentials and enter the new password. If you configured a Pluggable Authentication Modules (PAM) policy, the new password must comply with it. Otherwise, Local UI returns an error.

Terminal

1. Power up the Edge host.

2. Press the ALT + RIGHT ARROW keys, or CTRL + ALT + F1 on a keyboard connected to the Edge host. Replace ALT with OPTION on a Mac keyboard. This will bring up the login screen for you to log in to the terminal.

   Alternatively, establish an SSH connection to the Edge host.

3. Issue the command passwd.

4. Enter your current password to authenticate.

5. Enter your new password and press ENTER. Enter the new password again to confirm. If you configured a Pluggable Authentication Modules (PAM) policy, the new password must comply with it. Otherwise, the terminal returns an error.

API

1. Use the POST /v1/users/default/login endpoint to generate an authentication token with your OS username and password. The following curl command is an example. Replace edge-host-ip with the IP of your Edge host and replace os-username and os-password with your OS user credentials.

   curl --location 'https://edge-host-ip:5080/v1/users/default/login' \
   --header 'Content-Type: application/json' \
   --data '{
       "username": "******",
       "password": "******"
   }'

   If your credentials are valid, you will receive a authorization token.

   {
     "Token": {
       "Authorization": "******"
     }
   }

2. Issue the following command to change the password. Replace the authorization token with the one you obtained in the previous step. This will change the password of the user whose credentials you used to obtain the authorization token. You do not need to provide a username.

   curl --location 'https://edge-host-ip:5080/v1/users/default/password/reset' \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
   --data '{
   "newPassword": "******",
   "oldPassword": "******"
   }'
   --header 'Authorization: *******'

   If you configured a Pluggable Authentication Modules (PAM) policy, the new password must comply with it. Otherwise, the command returns an error with "code":"401".

   For more information about the API endpoint, refer to Reset User Password.

Validate

1. Log out of the console.

2. Enter your new credentials to log back in and confirm that the password has been updated.