Users and access
The box has one claim password (the admin from first setup) and, optionally, more accounts under Users, which is admin-only.
| admin | full control: services, streaming, files, users, schedule, secrets, setup, cluster, saves |
| user | a viewer whose file explorer works under /data and any shared drive |
| viewer | sees every page that is not admin-only, changes nothing except their own password. The server refuses viewer mutations; the greyed-out controls are the affordance, not the enforcement |
Passwords are eight characters or more.
Unix accounts and terminals
An account can also get a unix login, with its home at /data/home/<name>, which survives a reflash.
| SSH account | a shell over SSH, key-only: paste the user's public key. No password logins; root's own login is locked |
| browser terminal | a personal terminal on its own port (7701 and up), behind its own password; turn on the terminals service and share http://<box>.local:<port> |
| doas/sudo | become root with the account's own password (doas; sudo is spelled the same here). Never without a password. Needs an SSH or terminal account |
In any terminal claude is the Machine's one session, shared with the Assistant terminal and the dashboard chat (the assistant); detach with ctrl-b d.
Share-only accounts
A share-only account (made under Files → Network storage) exists so a share can authenticate it: no shell, no SSH key, no terminal, no dashboard sign-in. Its one credential is its SMB password. Deleting any unix account also removes it from every share and from the SMB password store.
Lockouts
Disabling an account locks it out immediately. You cannot delete your own account, and the last admin cannot be demoted or disabled: a box always has one way in. If every dashboard account is lost, the original claim password still signs in as the admin. A reboot signs everyone out.
On a cluster
Users are per Machine; nothing propagates. The Cluster page shows every member's users side by side, but editing is per box, as is the admin password.