|
| 1 | +--- |
| 2 | +title: Managing access to the Management Console |
| 3 | +shortTitle: Manage access |
| 4 | +intro: '{% ifversion enterprise-management-console-multi-user-auth %}You can increase the security of {% data variables.location.product_location %} by creating or deleting {% data variables.enterprise.management_console %} users. As the root site administrator, you {% else %}You {% endif %}can access the {% data variables.enterprise.management_console %} as well as configure {% data variables.enterprise.management_console %} authentication rate limits.' |
| 5 | +versions: |
| 6 | + ghes: '*' |
| 7 | +type: how_to |
| 8 | +topics: |
| 9 | + - Enterprise |
| 10 | + - Authentication |
| 11 | + - SSH |
| 12 | + - User account |
| 13 | +--- |
| 14 | + |
| 15 | +{% data reusables.enterprise_site_admin_settings.management-console-access %} For more information about {% data variables.enterprise.management_console %} access, see "[Accessing the {% data variables.enterprise.management_console %}](/admin/configuration/configuring-your-enterprise/accessing-the-management-console)." |
| 16 | + |
| 17 | +{% ifversion enterprise-management-console-multi-user-auth %} |
| 18 | +## Types of {% data variables.enterprise.management_console %} accounts |
| 19 | + |
| 20 | +There are two types of user accounts for the {% data variables.enterprise.management_console %} on a {% data variables.product.product_name %} instance. The root site administrator account authenticates with a password established during the initial setup of {% data variables.location.product_location %}. |
| 21 | + |
| 22 | +The root site administrator can create additional accounts, and assign one of two roles to each. |
| 23 | + |
| 24 | +### Root site administrator |
| 25 | + |
| 26 | +Root site administrators have complete control over the {% data variables.enterprise.management_console %}. They can take every action in the {% data variables.enterprise.management_console %}, including creating and deleting {% data variables.enterprise.management_console %} user accounts. |
| 27 | + |
| 28 | +Only the root site administrator can create and delete {% data variables.enterprise.management_console %} user accounts. |
| 29 | + |
| 30 | +### {% data variables.enterprise.management_console %} user |
| 31 | + |
| 32 | +{% data variables.enterprise.management_console %} users can perform most administrative tasks for {% data variables.location.product_location %}. For heightened security, {% data variables.enterprise.management_console %} users cannot create or delete {% data variables.enterprise.management_console %} user accounts. |
| 33 | + |
| 34 | +Only {% data variables.enterprise.management_console %} users with the operator role can manage SSH keys. |
| 35 | + |
| 36 | +The root site administrator can provision one of two roles for {% data variables.enterprise.management_console %} users: |
| 37 | + |
| 38 | +- **Editor**: A {% data variables.enterprise.management_console %} user with the editor role can perform basic administrative tasks for {% data variables.location.product_location %} in the {% data variables.enterprise.management_console %}. Editors cannot add public SSH keys to the {% data variables.enterprise.management_console %} to grant administrative SSH access to the instance. |
| 39 | +- **Operator**: A {% data variables.enterprise.management_console %} user with the operator role can perform basic administrative tasks for {% data variables.location.product_location %} in the {% data variables.enterprise.management_console %}. Users with the operator role can add SSH keys to the {% data variables.enterprise.management_console %} to grant administrative access to the instance via SSH. |
| 40 | + |
| 41 | +### Creating or deleting a user account for the {% data variables.enterprise.management_console %} |
| 42 | + |
| 43 | +While signed into the {% data variables.enterprise.management_console %} as the root site administrator, you can create new {% data variables.enterprise.management_console %} user accounts. |
| 44 | + |
| 45 | +{% data reusables.enterprise_site_admin_settings.click-user-management %} |
| 46 | +1. Click **Create user**. |
| 47 | +1. Fill in the user's name, username, and email address. |
| 48 | +1. Use the drop-down menu to select the user's role. You may select the editor or operator role. |
| 49 | +1. To finish creating the user account, click **Create**. If email notifications are configured for the instance, the user will automatically receive an invitation email with access instructions for the {% data variables.enterprise.management_console %}. For more information, see "[Inviting new {% data variables.enterprise.management_console %} users](#inviting-new-management-console-users)." |
| 50 | +1. Optionally, to delete a {% data variables.enterprise.management_console %} user account, click {% octicon "trash" aria-label="The trash symbol" %} to the right of any user account you wish to delete. Then confirm deletion. |
| 51 | + |
| 52 | +## Inviting new {% data variables.enterprise.management_console %} users |
| 53 | + |
| 54 | +If you have configured email for notifications for {% data variables.location.product_location %}, new {% data variables.enterprise.management_console %} users will automatically receive an invitation to complete creation of the {% data variables.enterprise.management_console %} user account. For more information, see "[Configuring email for notifications](/admin/configuration/configuring-your-enterprise/configuring-email-for-notifications)." |
| 55 | + |
| 56 | +If you have not configured email notifications for {% data variables.location.product_location %}, you must manually copy the {% data variables.enterprise.management_console %} invitation link and send it to the user. The user must set a password using the link before the user can access the {% data variables.enterprise.management_console %}. |
| 57 | + |
| 58 | +{% data reusables.enterprise_site_admin_settings.sign-in-as-root-administrator %} |
| 59 | +{% data reusables.enterprise_site_admin_settings.click-user-management %} |
| 60 | +1. To copy the invitation link, click {% octicon "link" aria-label="Copy invitation link" %} on any {% data variables.enterprise.management_console %} user account. |
| 61 | +1. Send the invitation link to the {% data variables.enterprise.management_console %} user. The invitation link will lead the user through the final account setup steps. |
| 62 | + |
| 63 | +{% endif %} |
| 64 | + |
| 65 | +{% ifversion enterprise-authentication-rate-limits %} |
| 66 | +## Configuring rate limits for authentication to the {% data variables.enterprise.management_console %} |
| 67 | + |
| 68 | +You can configure the lockout time and login attempt limits for the {% data variables.enterprise.management_console %}. If you configure rate limits, the limits apply to both the root site administrator and any {% data variables.enterprise.management_console %} users. |
| 69 | + |
| 70 | +After you configure rate limits and a user exceeds the limit, the {% data variables.enterprise.management_console %} will remain locked for the duration set by the lockout time. {% data reusables.enterprise_management_console.unlocking-management-console-with-shell %} |
| 71 | + |
| 72 | +{% data reusables.enterprise_site_admin_settings.access-settings %} |
| 73 | +{% data reusables.enterprise_site_admin_settings.management-console %} |
| 74 | +2. Under "Login attempt rate limiting", configure the lockout time and login attempt rate limit or accept the pre-filled default settings. |
| 75 | + |
| 76 | +{% data reusables.enterprise_management_console.save-settings %} |
| 77 | + |
| 78 | +{% endif %} |
0 commit comments