Manage Users and Roles

Last updated 24 September 2026

Create, edit, and delete user accounts on a Brainsalt server. Assign one of three roles to control what each person can see and do in the System Management web interface.

Before you start

  • You are signed in to the server's System Management web interface with an Administrator account. Only Administrators can manage users.
  • If this is a new server, the default administrator account is ADMIN with password ADMIN2!!. Change this password immediately after first sign-in.

Steps

1. Open the Access page

In the System Management sidebar, under Configure, select Access. The page shows the current user list, the add-user form, and several related settings (services, BMC sync, VNC password, front-panel access code).

2. Create a new user

Scroll to the Add user section. Enter a username (4–16 characters; letters, digits, .-_ only), a password that meets the password policy, and pick a role from the dropdown. Click Add. The new user appears in the table immediately.

Usernames are case-sensitive.Operator and operator are two different accounts. This matches how the server's BMC hardware stores usernames.

3. Change a user’s role

In the Users table, find the user and change their Role dropdown. The change takes effect immediately. The user’s active sessions are terminated, so they will need to sign in again.

4. Reset a user’s password

Click Reset password next to the user. A dialog asks for the new password. The new password must meet the password policy. The user’s active sessions are terminated.

5. Delete a user

Click Delete next to the user and confirm. The user is removed and their active sessions are terminated. You cannot delete the last remaining Administrator — at least one must always exist.

Every change here also applies to the BMC. By default, the server mirrors this user list to its BMC: the same usernames, the same passwords and the same roles. Adding a user, deleting one, changing a role or resetting a password (steps 2–5) does the same on the BMC. The Brainsalt Hub Desktop App depends on this. Its BMC button signs you in to the controller with your server login, so you get the same access there as you have here. See Access the BMC KVM Console from Brainsalt Hub.

Roles explained

Every user has exactly one role. Roles are ranked: each higher role inherits all permissions of the ones below it. While BMC synchronization is on, each user gets the BMC privilege level of the same name.

Role

Can do

Typical use

User

Read and monitor only: Overview, GPU Status, Resource Usage, Storage, Hardware (read-only), Logs, Notes, Web Consoles.

Monitoring dashboards, read-only status checks.

Operator

Everything a User can do, plus operate: File Transfer, Applications start/stop, Power actions (shutdown, restart), Remote UIs.

Day-to-day show operation and content loading.

Administrator

Everything, including all Configure pages (Access, Network, GPU, Settings, Backup & Restore, Hardware Baseline, Notes) and VNC screen control.

System integrators, IT administrators, initial setup.

Options explained

Setting

Description

Values / Range

Username

The account name used to sign in. Case-sensitive. Cannot be changed after creation.

4–16 characters: letters, digits, .-_

Password

The account password. Must include at least one digit and at least one special (non-alphanumeric) character.

8–16 characters

Role

Determines what the user can see and do. Can be changed at any time from the Users table.

USEROPERATORADMINISTRATOR

Reset password

Sets a new password for an existing user. Terminates all of the user’s active sessions.

Button (per user)

Delete

Permanently removes the user account. Blocked if this is the last Administrator.

Button (per user)

Keep BMC users synchronized

Mirrors every user account to the server’s BMC over IPMI, with the same username, password and role. The sync runs when the server starts and whenever a user is added, changed or deleted. The Brainsalt Hub’s BMC sign-in (Same as User) relies on it. Untick it only if you manage the BMC’s accounts yourself.

Checkbox · on by default

Update BMC now

Immediately pushes all current user accounts to the BMC, without waiting for the next automatic sync.

Button

Password policy

All passwords — at creation and on reset — must meet these requirements:

  • 8 to 16 characters long

  • At least one digit (0–9)

  • At least one special character (any character that is not a letter or digit)

The 16-character maximum exists because passwords are synchronized to the BMC, which stores them as 16 bytes via IPMI.

Common Mistakes

  • "Cannot delete the last administrator" — The system requires at least one Administrator at all times. To remove the current admin, create a second Administrator account first, then delete the original.

  • "Cannot demote the last administrator" — Same rule applies to role changes. You cannot change the last Administrator to Operator or User. Promote another user to Administrator first.

  • Login fails after a role change or password reset — Both actions terminate the affected user’s active sessions. This is expected. The user needs to sign in again with their (new) credentials.

  • Username case mismatch — Usernames are case-sensitive. If a user types admin instead of ADMIN, the login will fail. Verify the exact case used when the account was created.

  • "Maximum number of users reached" — The server supports a maximum of 15 user accounts. Delete unused accounts to free a slot.

  • A user can sign in here but not on the BMC — First check that Keep BMC users synchronized is ticked, then click Update BMC now. An account created before BMC synchronization existed on this server has no password the server can pass on. It reaches the BMC with its name and role but stays disabled there. Reset that user’s password once, and the BMC account is enabled with the new password.

Tips

  • Change the default ADMIN password as your first step on a new server. The system shows a security warning on every session until you do.

  • If all Administrator accounts are accidentally deleted or corrupted, the system self-heals by recreating the default ADMIN account with the factory password on next service start. You will not be permanently locked out.

  • Leave Keep BMC users synchronized on (the default). Then everyone signs in to the BMC with the same credentials and role they use for the web interface, and the Hub’s BMC button logs them straight in. Manage BMC access on this page, not in the BMC’s own interface: the server’s list is the one that is mirrored.

  • Use the Operator role for show-operations staff who need to start/stop applications, transfer files, and control power — but should not change network, GPU, or user settings.

  • The Access page also lets you set minimum privilege levels for individual services (File Transfer, VNC, Remote UI). Use these to further restrict who can access specific features, independent of their role.

Sign In to a Server for the First Time — Reach a server, trust its certificate, sign in with the default administrator, and change the default password.

Access the BMC KVM Console from Brainsalt Hub — open the BMC from the Hub, signed in with the synchronized account.