> ## Documentation Index
> Fetch the complete documentation index at: https://sambanova-systems.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Device credentials

This guide covers managing device credentials in SambaRack Manager. SambaRack Manager requires individual device credentials to perform administrative functions. Credentials are stored in an encrypted file (`secrets.json.enc`) protected by AES-GCM encryption.

<Note>
  SambaRack Manager acts as a local password vault. It does not change device passwords, push credentials, or manage device authentication.
</Note>

The complete setup process is:

1. Install SambaRack Manager software
2. Initial setup and verification
3. Add SambaRack to the SambaRack Manager inventory
4. **Configure device credentials in SambaRack Manager** (this page)

## For new installations

If you are setting up SambaRack Manager for the first time, complete the following steps.

### Step 1. Set device credentials

SambaRack units ship with default passwords. It is recommended that you change these at the earliest convenience. Refer to the Hardware Administration guide for each device type for specific instructions.

Before setting credentials, review the [Password requirements](#password-requirements) section.

### Step 2. add credentials to SambaRack manager

After device credentials are set and conform to the password requirements, use the `snctl secret set` command to add credentials for all device types. See [Set secret](#set-secret) for details.

**After completing this step, SambaRack Manager is ready for use.**

## Commands

Use the following commands to manage device credentials.

### Set secret

Set or update the password for a device type:

```bash theme={null}
snctl secret set --device-type <device_type>
```

You are prompted to enter the secret value securely.

**When to use this command:**

* When a new rack or device is added to the SambaRack Manager inventory
* When credentials of any devices are changed
* When a device or hardware FRU is replaced (the new device credentials must be updated from default values)

**Example:**

```bash theme={null}
snctl secret set --device-type host
Enter secret value: ••••••••
```

**Device types:**

Set credentials for each of the following device types:

| Device type     | Command                                          |
| --------------- | ------------------------------------------------ |
| BMC             | `snctl secret set --device-type bmc`             |
| Host            | `snctl secret set --device-type host`            |
| XRDU            | `snctl secret set --device-type xrdu`            |
| PDU             | `snctl secret set --device-type pdu`             |
| Access switch   | `snctl secret set --device-type access_switch`   |
| Data switch     | `snctl secret set --device-type data_switch`     |
| Serial terminal | `snctl secret set --device-type serial_terminal` |

### Get secret (masked)

View a secret with the value partially masked:

```bash theme={null}
snctl secret get --device-type <device_type>
```

**Example:**

```bash theme={null}
snctl secret get --device-type bmc
```

**Example output:**

For secrets with 4 or fewer characters:

```yaml theme={null}
bmc: ***
```

For secrets with more than 4 characters:

```yaml theme={null}
bmc: My***3!
```

### Get secret (unmasked)

View a secret with the full value displayed:

```bash theme={null}
snctl secret get --device-type <device_type> --show-value
```

**Example:**

```bash theme={null}
snctl secret get --device-type bmc --show-value
```

**Example output:**

```yaml theme={null}
bmc: MySecurePassword123!
```

<Warning>
  Only use `--show-value` in secure environments. Never share the output.
</Warning>

## Password requirements

This section describes important requirements and limitations for device credentials.

### Common passwords per device type

All devices of the same type must use the same password. For example:

* All BMCs share one password
* All XRDUs share one password
* All hosts share one password

<Note>
  This is a current limitation. Support for per-device or per-rack passwords is planned for future releases.
</Note>

### Password sync requirements

SambaRack Manager does not automatically sync with device passwords. You must manually update credentials when changes occur:

| Action                               | Required steps                                         | When                      |
| ------------------------------------ | ------------------------------------------------------ | ------------------------- |
| Change device password               | Update the device first, then update SambaRack Manager | Immediately after change  |
| Rotate passwords                     | Update devices first, then update SambaRack Manager    | During maintenance window |
| Troubleshoot authentication failures | Verify device passwords match SambaRack Manager        | When operations fail      |

### Data loss prevention

<Warning>
  If SambaRack Manager credentials fall out of sync with device passwords, you will be unable to:

  * Power cycle nodes
  * Access BMCs
  * Modify node configurations
  * Perform remote operations

  Always verify that SambaRack Manager credentials match actual device passwords before critical operations.
</Warning>