First sign-in#

The machine reboots into the installed system and prints a banner above the login prompt with the web UI address on every interface it has an address on. Browse to that address — the port is 8443 and the scheme is https — accept the self-signed certificate, and sign in as admin with the password you chose during the install. If the box was installed some other way, or the install could not copy the agent's data across, the banner tells you the password instead.

The console banner#

  Wheelhouse 0.5.1 -- edge
  ==========================================================================
  Web UI:    https://192.168.1.1:8443  (eth1)
  Sign in:   with your Wheelhouse admin account
  Console:   vyos, with the password chosen at install
  --------------------------------------------------------------------------
  Built on VyOS wheelhouse-0.5.1
  Licences and source offer: /usr/share/doc/wheelhouse
  ==========================================================================

It is rewritten at boot and every 20 seconds after that. When the text changes and nobody is logged in on a console, that console's login prompt is restarted so the new banner is drawn at once, rather than waiting for someone to press Enter.

Reading it:

• One Web UI: line per addressed interface, IPv4 first, then IPv6 in brackets. Up to five are listed; beyond that it says how many more there are, so that a router with a dozen VLANs does not push the login prompt off the screen.
• "waiting for an address on any interface" means the machine has not got one yet. Plug something in, or set an address from the console.
• An Agent: line appears only when the agent is not active, and names the command to read its log.
• [live image, not installed] on the first line means you are still on the stick.
• The last two lines are the attribution and the path to the licences and the corresponding-source offer on the machine itself.

The address and the port#

8443, over HTTPS. Some older material says 8090; that is the developer install, where the agent runs off-router against an existing VyOS box. It is not this.

The shipped systemd unit runs the agent with --addr 0.0.0.0:8443, which means it listens on every interface, including the WAN. Nothing but the firewall keeps the management UI off the internet. With the installer's firewall written and a LAN configured, the UI is reachable from the LAN and from nowhere else.

The certificate warning#

Your browser will warn. The agent generates a self-signed certificate on first start, because --tls-self-signed is in the shipped unit:

Add a security exception for this host. Do not import it into a root store: it is a leaf certificate for one machine, and an earlier build that generated it as a CA was replaced precisely because following that instruction would have made a key on a router a trust anchor for every site you visit. The agent replaces such a certificate on sight if it finds one.

The certificate is reused across restarts, and regenerated when it is unreadable, when it is a CA, or when it is within 30 days of expiring. The better answer is to replace it with one your browsers already trust, so that a certificate warning starts meaning something again.

Signing in#

Sign in as admin with the password you typed during the install.

If the banner says Sign in: admin / <some string>#

The installer could not copy the agent's data onto the disk and the agent started fresh. That string is a one-time password the agent generated and wrote to /config/wheelhouse/initial-password, mode 600. Sign in with it. The file is deleted the moment that account's password changes.

The same thing happens on any machine where the agent starts with no accounts at all — a .deb installed on a stock VyOS box, for instance. The password is also logged once, at warning level, in the agent's journal.

The forced password change#

The bootstrap admin account is created with must_change_password set, and so is any account an administrator creates or resets. While that flag is set, a password screen stands in front of every router page — not a banner on an account page, which turned out not to be a gate at all: an operator would land on the Dashboard, never visit the account page, and keep running the box on a password printed on the physical console.

The screen asks for the current password and the new one twice. It shows a strength note as you type — Strong, Reasonable, Workable, or a line saying short and simple is accepted but a passphrase is better. The note is advice and can never block the form. Any non-empty password is accepted; there is no minimum length and no character rule. The app only lets go of the gate once the agent has confirmed the change, not on an optimistic local edit.

What you can do before you have a licence#

Everything that reads. An unlicensed router signs you in and shows every page, every counter, every log and the audit trail. It refuses to stage, commit, roll back, install an app or run the reconcile loop, and the refusal names the fix. Enter a licence is the next page.

See also#

• Enter a licence — what an unlicensed router will and will not do.
• The first hour — the four things worth doing straight away.
• If the install goes wrong — no banner, no address, no 8443.
• Serial consoles — what the banner says on a serial line.
• Accounts and sessions — what the password gate is guarding.
• Roles and the three planes — what admin can do that other roles cannot.
• Working from the console — the banner, the login and the shell.
• Locked out — when the sign-in is the problem.
• The Dashboard — the first page you land on.

Checked against packaging/console-banner.sh, packaging/wheelhouse-console.service, packaging/wheelhouse-console.timer, packaging/firstboot.sh, packaging/wheelhouse-agent.service, ui/src/components/PasswordGate.tsx, agent/main.go, agent/authhttp.go, agent/tls.go, docs/install.md, docs/security.md.