> ## Documentation Index
> Fetch the complete documentation index at: https://sambanova-systems.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Device credentials

This guide covers managing device credentials in SambaRack Manager. SambaRack Manager requires individual device credentials to perform administrative functions. Credentials are stored in an encrypted file (`credentials.json.enc`) protected by AES-GCM encryption.

<Note>
  SambaRack Manager acts as a local password vault. It does not change device passwords, push credentials, or manage device authentication.
</Note>

The complete setup process is:

1. Install SambaRack Manager software
2. Initial setup and verification
3. Add SambaRack to the SambaRack Manager inventory
4. **Configure device credentials in SambaRack Manager** (this page)

## How credentials work

Read this section once. Everything after it depends on these four things.

### SambaRack Manager is a password vault, not a password manager

<Note>
  SambaRack Manager stores the credentials you give it so it can authenticate to your devices. It does **not** change device passwords, push credentials to hardware, or manage device authentication in any way.
</Note>

You set the passwords on the hardware. SambaRack Manager remembers them.

### Credentials are encrypted at rest

Credentials are stored in `credentials.json.enc`, protected by AES-GCM encryption. The encryption key is generated during initial setup and lives in your configuration directory. Passwords are never written to logs.

### One shared password per device type

By default, every device of a given type shares that type's password — all BMCs share one, all XRDUs share one, all hosts share one.

To give a single device its own password, set a [per-device credentials](#optional-per-device-credentials). There is no per-rack password.

### Nothing syncs automatically

SambaRack Manager has no way to detect that a password changed on a device. If the two fall out of sync, every operation that authenticates to that device fails.

| Action                                 | Required steps                                         | When                          |
| -------------------------------------- | ------------------------------------------------------ | ----------------------------- |
| Change a device password               | Update the device first, then update SambaRack Manager | Immediately after the change  |
| Rotate passwords                       | Update devices first, then update SambaRack Manager    | During the maintenance window |
| Troubleshoot an authentication failure | Verify device passwords match SambaRack Manager        | As the first debugging step   |

<Warning>
  If SambaRack Manager credentials fall out of sync with device passwords, you will be unable to:

  * Power cycle nodes
  * Access BMCs
  * Modify node configurations
  * Perform remote operations

  Because the failure surfaces at the point of connection, it often looks like a network or hardware fault rather than a credential problem. Always verify credentials match before critical operations.
</Warning>

***

## Set up credentials

### Step 1 — Set the passwords on your hardware

SambaRack units ship with default passwords. **Change these at the earliest opportunity.** Refer to the Hardware Administration guide for each device type for specific instructions.

### Step 2 — Register each password with SambaRack Manager

```bash theme={}
snctl secret set --device-type <device_type>
```

You are prompted to enter the value securely — it is not echoed to the terminal.

```bash theme={}
snctl secret set --device-type host
Enter secret value: ••••••••
Confirm secret value: ••••••••
```

```text theme={}
✓ Secret set for host (host)
```

An empty or whitespace-only value is rejected.

Repeat for every device type in your inventory:

| Device type     | Value for `--device-type` |
| --------------- | ------------------------- |
| BMC             | `bmc`                     |
| Host            | `host`                    |
| XRDU            | `xrdu`                    |
| PDU             | `pdu`                     |
| Access switch   | `access_switch`           |
| Data switch     | `data_switch`             |
| Serial terminal | `serial_terminal`         |

<Note>
  At minimum, register `bmc`, `host`, and `xrdu` before attempting any power operation — power commands authenticate to all three.
</Note>

**After completing this step, SambaRack Manager is ready for use.**

***

## Manage credentials

### Set or update a password

The same command sets a new credential and updates an existing one:

```bash theme={}
snctl secret set --device-type <device_type>
```

Run it whenever:

* A new rack or device is added to the inventory
* The credentials on any device change
* A device or hardware FRU is replaced — the new device's credentials must be updated from their default values

### View a password

```bash theme={}
snctl secret get --device-type <device_type>
```

Values are masked by default:

```bash theme={}
snctl secret get --device-type bmc
```

| Secret length          | Output         |
| ---------------------- | -------------- |
| More than 4 characters | `bmc: My***3!` |
| 4 characters or fewer  | `bmc: ***`     |

To display the full value, add `--show-value`:

```bash theme={}
snctl secret get --device-type bmc --show-value
```

```yaml theme={}
bmc: MySecurePassword123!
```

<Warning>
  Only use `--show-value` in a secure environment. It prints the password in clear text, where it persists in terminal scrollback and shell history. Never share the output or paste it into a ticket, chat, or document.
</Warning>

Add `-o json` to either form for machine-readable output.

### Remove a password

Pass `--clear` instead of entering a value. Nothing is prompted.

```bash theme={}
snctl secret set --device-type bmc --clear
```

```text theme={}
✓ Secret cleared for bmc
```

Clearing a credential that was never set succeeds without error.

<Warning>
  Clearing a device-type credential leaves **every** device of that type without a password. Power and firmware operations against all of them fail until you set a new one.
</Warning>

***

## (Optional) Per-device Credentials

When a single device does not share its type's password, give it its own credential by canonical device path. A per-device credential takes precedence over the device-type password.

### Set an override

```bash theme={}
snctl secret set --device <device_path>
```

```bash theme={}
snctl secret set --device Rack/001/Node/0/bmc
Enter secret value: ••••••••
Confirm secret value: ••••••••
```

```text theme={}
✓ Secret set for device Rack/001/Node/0/bmc
```

See [Device paths and indexing](srm-rack-admin#device-paths-and-indexing) for the path format.

### Check which credential a device resolves to

`snctl secret get --device` reports the credential the device actually uses and names the tier it came from, so you can confirm whether an override is in effect or the device is falling back to its type:

```bash theme={}
snctl secret get --device Rack/001/Node/0/bmc
```

**An override is set:**

```powershell theme={}
Rack/001/Node/0/bmc (device override): My***3!
```

**No override — falling back to the device type:**

```powershell theme={}
Rack/001/Node/0/bmc (default: bmc): Sh***d!
```

`--show-value` and `-o json` work here too; the JSON output includes the resolution tier.

### Remove an override

Clear the same path. The device then falls back to the credential for its device type:

```bash theme={}
snctl secret set --device Rack/001/Node/0/bmc --clear
```

```text theme={}
✓ Secret cleared for device Rack/001/Node/0/bmc
```

***

## Next steps

Setup is complete. Your inventory is populated and SambaRack Manager can authenticate to your devices — you can now start managing your hardware.

| Guide                                    | What you can do                                                                                            |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| [Node administration](srm-node-admin)    | View node details, look up device connection information, and rename nodes                                 |
| [Group administration](srm-group-admin)  | Organize racks into named groups so a single command can target several racks at once                      |
| [Power Operations](srm-power-admin)      | Check power state, and power nodes on, off, or through a full cycle                                        |
| [Firmware Updates](srm-firmware-updates) | Compare installed firmware against the plan of record, and upgrade BIOS, BMC, XRDU, and Thor Card firmware |

<Note>
  If you are new to SambaRack Manager, start with [Node administration](srm-node-admin) and [Power Operations](srm-power-admin) — `snctl node list` and `snctl power state --help` are both read-only, so they are a safe way to confirm your inventory and credentials are correct before running any operation that changes hardware state.
</Note>