{% extends "base.html.twig" %}

{% block title %}How to manage Auth Profiles{% endblock %}

{% block body %}

    <div class="container-fluid">
        <div class="row">
            <div class="col-md-12">
                <div class="bgc-white bd bdrs-3 p-20 mB-20">
                    <h4 class="c-grey-900"><i class="c-yellow-500 fas fa-question-circle"></i> Authentication Profiles</h4>
                    <hr>
<p class = "text-justify">
Authentication profiles are governing direct server -&gt; device connection credentials. Authentication profile specifies a few pieces of configuration:
<ul>
<li>Username - this is the username that is used when connecting to the device via SSH.</li>
<li>SSH Password - Password to be used when connecting to the device via SSH. You must specify either password or key (below) in the Auth profile.</li>
<li>SSH Key - Private SSH Key to be used when connecting to the device via SSH. You must specify either password (above) or key in the Auth profile.</li>
</ul>
</p>
<p class = "text-justify">
When the connection is attempted, first the key-based authentication is done (if the SSH Key is defined in the Auth profile). If SSH Key is not defined, password-authentication is done.
</p>
<p class = "text-justify">
Once you have any Auth Profile defined, you can assign it to a particular device in it's Device Details. A device can have only one Auth Profile assigned.
</p>
<p class = "text-justify">
The secrets (passwords, keys) are stored in the database. Only root and DWARFG_SHORT users are allowed DB access but you need to pay attention to any DB dumps (DB backups) stored in the filesystem if you have such backups configured. Anybody with access to the DB dump can access the secrets data. To alleviate the potential situation a little bit, the secrets are not stored as plaintext but in encoded form. While the encoding is making reading the plaintext form directly out of the database (or a DB dump) impossible, a determined and able attacker will be able to decode the data and thus access your device's passwords or SSH keys should you allow the attacker to access the data. You cannot neglect protecting your server and any potential DB dumps/backups you are making. Pay close attention to your server/DB backup configuration and storage of and access to the backup data itself.
</p>
                </div>
            </div>
        </div>
    </div>

{% endblock body %}