Access profiles

Give someone access to a few services on many servers, and nothing else. An access profile creates a Linux user that can only manage the systemd services you pick: check their status, restart them, read their logs. You apply it to many hosts at once, and you can revoke it or let it expire on its own.

Create a profile

Open a vault → Access Profiles → Add profile:

1. User — a Name (for example "Web operators") and the Linux username. The username can't change after the profile is created.
2. Login key — Generate a key (a new ed25519 key, saved in the vault as an identity so you can share it or connect as that user), or paste the person's own public key.
3. Services — add each systemd service and tick the Allowed actions: status, start, stop, restart, reload and logs. Load the service list from a host fills in suggestions with the names systemd uses. Optionally list Config files they may edit, one per line; they're edited with sudoedit.
4. Hosts — pick hosts, or whole groups. Hosts added to a group later are included the next time you apply.
5. When access ends — optionally set an expiry date and whether the account is then locked or deleted, and what revoke does: lock the account (keeps the home folder) or delete the account and home folder.
6. Save.

Apply, refresh, revoke

• Click Apply… on the profile card. Each host is first checked read-only; nothing changes yet. Review which hosts are ready, open Script to see exactly what will run, then Apply to N hosts.
• Each host is changed all-or-nothing, with live per-host progress. A host that needs a sudo password asks for it. You can enter it once for all, or Skip host.
• Retry N failed reruns only the hosts that failed.
• After editing a profile, Apply… again to update the hosts.
• Revoke… on the card's menu ends access on the hosts, with the same check and review steps.

Good to know

• Expiry is enforced by a timer on each host, so it works even when Kubexer Terminal is closed.
• Deleting a profile in the app does not remove the user from any host. Revoke it first.
• Letting someone edit a service's config is close to root for that service, because they can change what it runs. Grant it only to people you'd trust with that.
• Hosts need systemd, and the account you connect with needs root or sudo rights.

Related

Share an identity · Hosts & groups