Skip to main content
This guide covers managing device credentials in SambaRack Manager. SambaRack Manager requires individual device credentials to perform administrative functions. Credentials are stored in an encrypted file (credentials.json.enc) protected by AES-GCM encryption.
SambaRack Manager acts as a local password vault. It does not change device passwords, push credentials, or manage device authentication.
The complete setup process is:
  1. Install SambaRack Manager software
  2. Initial setup and verification
  3. Add SambaRack to the SambaRack Manager inventory
  4. Configure device credentials in SambaRack Manager (this page)

​
How credentials work

Read this section once. Everything after it depends on these four things.

​
SambaRack Manager is a password vault, not a password manager

SambaRack Manager stores the credentials you give it so it can authenticate to your devices. It does not change device passwords, push credentials to hardware, or manage device authentication in any way.
You set the passwords on the hardware. SambaRack Manager remembers them.

​
Credentials are encrypted at rest

Credentials are stored in credentials.json.enc, protected by AES-GCM encryption. The encryption key is generated during initial setup and lives in your configuration directory. Passwords are never written to logs.

​
One shared password per device type

By default, every device of a given type shares that type’s password — all BMCs share one, all XRDUs share one, all hosts share one. To give a single device its own password, set a per-device credentials. There is no per-rack password.

​
Nothing syncs automatically

SambaRack Manager has no way to detect that a password changed on a device. If the two fall out of sync, every operation that authenticates to that device fails.
If SambaRack Manager credentials fall out of sync with device passwords, you will be unable to:
  • Power cycle nodes
  • Access BMCs
  • Modify node configurations
  • Perform remote operations
Because the failure surfaces at the point of connection, it often looks like a network or hardware fault rather than a credential problem. Always verify credentials match before critical operations.

​
Set up credentials

​
Step 1 — Set the passwords on your hardware

SambaRack units ship with default passwords. Change these at the earliest opportunity. Refer to the Hardware Administration guide for each device type for specific instructions.

​
Step 2 — Register each password with SambaRack Manager

You are prompted to enter the value securely — it is not echoed to the terminal.
An empty or whitespace-only value is rejected. Repeat for every device type in your inventory:
At minimum, register bmc, host, and xrdu before attempting any power operation — power commands authenticate to all three.
After completing this step, SambaRack Manager is ready for use.

​
Manage credentials

​
Set or update a password

The same command sets a new credential and updates an existing one:
Run it whenever:
  • A new rack or device is added to the inventory
  • The credentials on any device change
  • A device or hardware FRU is replaced — the new device’s credentials must be updated from their default values

​
View a password

Values are masked by default:
To display the full value, add --show-value:
Only use --show-value in a secure environment. It prints the password in clear text, where it persists in terminal scrollback and shell history. Never share the output or paste it into a ticket, chat, or document.
Add -o json to either form for machine-readable output.

​
Remove a password

Pass --clear instead of entering a value. Nothing is prompted.
Clearing a credential that was never set succeeds without error.
Clearing a device-type credential leaves every device of that type without a password. Power and firmware operations against all of them fail until you set a new one.

​
(Optional) Per-device Credentials

When a single device does not share its type’s password, give it its own credential by canonical device path. A per-device credential takes precedence over the device-type password.

​
Set an override

See Device paths and indexing for the path format.

​
Check which credential a device resolves to

snctl secret get --device reports the credential the device actually uses and names the tier it came from, so you can confirm whether an override is in effect or the device is falling back to its type:
An override is set:
No override — falling back to the device type:
--show-value and -o json work here too; the JSON output includes the resolution tier.

​
Remove an override

Clear the same path. The device then falls back to the credential for its device type:

​
Next steps

Setup is complete. Your inventory is populated and SambaRack Manager can authenticate to your devices — you can now start managing your hardware.
If you are new to SambaRack Manager, start with Node administration and Power Operations — snctl node list and snctl power state --help are both read-only, so they are a safe way to confirm your inventory and credentials are correct before running any operation that changes hardware state.