Skip to main content

6. Users

The first thing after logging in for security reasons is 

  1. Create a new user different from root

Go to System > Access > Users > + Add user

Add a new user name, password, and other settings as you please. 

Finally, it is important to add a public ssh key from your laptop or computer to it s.t if you want to login in the ssh shell then you will login with an ssh key instead of the a password which is more insecure. 

2. Now, that a new user has been created we will log out from root and login with the new username

3. Then we will go back again to users and disable root login by clicking on the edit button at the root user and check the box "disable login". From that moment you can only login with the new user account you have created in the WebGui

4. Now, regarding SSH shell access it is best to leave it turned off and only activate via the WebGui when you actually need it. However, it can happen that you won't have access to the WebGui if you made a change that by accident turned off webgui access. But if you are at the location of your OPNSense box then you can still login via the local console or if you have a KVM setup then even remote access would still be possible. Hence, this is a decision you need to make for your self. In my opinion leaving it off is best for security purposes.

5. By default shell login is already turned off so you don't need to do anything. However, if you want to turn it on you go to System > Settigns > Administration. From there you scroll down and hit the box "Enable Secure Shell".