SSH Intro CtrlX Core

[jimiDMBthing]

I have never been able to SSH into my CtrlX Core Demo.  I've tried using PowerShell on Windows with OpenSSH enabled.  I've also tried putty.  I have the standard boschrexroth user configured on the demo.  I always fail with the password for some reason.  Is there a setting or security issue I'm missing when trying to SSH?  The SSH protocol status in the CtrlX web portal shows activated.  Any ideas?

[CodeWasi]

Hi,

yes the standard-PW is not working. And in future the SSH connection gets closed soon.

I am going to contact you if you need further details.

bye Jens

[mlaml]

Hi,

unfortunately this is not 100% correct Jens.

To enable SSH access, a user must be member of the group "sshuser". You can check this via the user's details tab, in this case: Users & Permissions -> Users -> boschrexroth -> Groups. If the box for sshuser is not checked, the user is not allowed to login via SSH.

By default, currently the following settings apply:

• SSH is activated
• boschrexroth is not a member of the "sshuser" group (and therefore not permitted to log in via SSH)
• The password is identical to the one that you configured for the user's web access

Unfortunately - most likely by design, due to security considerations - the SSH server does disclose as few details as possible about the reason why a connection attempt failed. Usually, it just states "Authentication failed". 

In future releases, the default behaviour of the system might change in one aspect: SSH might be disabled by default. Nevertheless, as an administrator you always may decide to re-enable SSH via the sidebar entry.

One last remark: Although you are able to access the system via SSH, the boschrexroth user only provides limited access to the system. It does not provide superuser privileges.

Kind regards,

Michael

[bschmidt]

Hello,

For Rexroth application engineers, is there a super user login we are allowed to use to give us higher permissions with SSH?

Thanks,

Brian

[CodeShepherd · Accepted solution]

There are no hidden users for internal engineers. There are following options:

• Activation of access on a development device: A root access is created by specifying the serial number. The device is now permanently stored in our database as a development device. This mechanism is intended for our developers, but not for putting a device into operation.
• Temporary activation in case of service: In exceptional cases, it may be necessary to create a temporary superuser in case of service (for example to modify system files). For this special exceptional case, there are "service" assertions that allow a time-limited root access (usually 1-2 days initially) which is automatically deleted.

EDIT: See this thread for news  to this topic.