Skip to main content
This guide covers managing device credentials in SambaRack Manager. SambaRack Manager requires individual device credentials to perform administrative functions. Credentials are stored in an encrypted file (secrets.json.enc) protected by AES-GCM encryption.
SambaRack Manager acts as a local password vault. It does not change device passwords, push credentials, or manage device authentication.
The complete setup process is:
  1. Install SambaRack Manager software
  2. Initial setup and verification
  3. Add SambaRack to the SambaRack Manager inventory
  4. Configure device credentials in SambaRack Manager (this page)

​
For new installations

If you are setting up SambaRack Manager for the first time, complete the following steps.

​
Step 1. Set device credentials

SambaRack units ship with default passwords. It is recommended that you change these at the earliest convenience. Refer to the Hardware Administration guide for each device type for specific instructions. Before setting credentials, review the Password requirements section.

​
Step 2. Add credentials to SambaRack Manager

After device credentials are set and conform to the password requirements, use the snctl secret set command to add credentials for all device types. See Set secret for details. After completing this step, SambaRack Manager is ready for use.

​
Commands

Use the following commands to manage device credentials.

​
Set secret

Set or update the password for a device type: 
snctl secret set --device-type <device_type>
You are prompted to enter the secret value securely. When to use this command:
  • When a new rack or device is added to the SambaRack Manager inventory
  • When credentials of any devices are changed
  • When a device or hardware FRU is replaced (the new device credentials must be updated from default values)
Example: 
snctl secret set --device-type host
Enter secret value: ••••••••
Device types: Set credentials for each of the following device types:
Device typeCommand
BMCsnctl secret set --device-type bmc
Hostsnctl secret set --device-type host
XRDUsnctl secret set --device-type xrdu
PDUsnctl secret set --device-type pdu
Access switchsnctl secret set --device-type access_switch
Data switchsnctl secret set --device-type data_switch
Serial terminalsnctl secret set --device-type serial_terminal

​
Get secret (masked)

View a secret with the value partially masked: 
snctl secret get --device-type <device_type>
Example: 
snctl secret get --device-type bmc
Example output: For secrets with 4 or fewer characters: 
bmc: ***
For secrets with more than 4 characters: 
bmc: My***3!

​
Get secret (unmasked)

View a secret with the full value displayed: 
snctl secret get --device-type <device_type> --show-value
Example: 
snctl secret get --device-type bmc --show-value
Example output: 
bmc: MySecurePassword123!
Only use --show-value in secure environments. Never share the output.

​
Password requirements

This section describes important requirements and limitations for device credentials.

​
Common passwords per device type

All devices of the same type must use the same password. For example:
  • All BMCs share one password
  • All XRDUs share one password
  • All hosts share one password
This is a current limitation. Support for per-device or per-rack passwords is planned for future releases.

​
Password sync requirements

SambaRack Manager does not automatically sync with device passwords. You must manually update credentials when changes occur:
ActionRequired stepsWhen
Change device passwordUpdate the device first, then update SambaRack ManagerImmediately after change
Rotate passwordsUpdate devices first, then update SambaRack ManagerDuring maintenance window
Troubleshoot authentication failuresVerify device passwords match SambaRack ManagerWhen operations fail

​
Data loss prevention

If SambaRack Manager credentials fall out of sync with device passwords, you will be unable to:
  • Power cycle nodes
  • Access BMCs
  • Modify node configurations
  • Perform remote operations
Always verify that SambaRack Manager credentials match actual device passwords before critical operations.