Docs

Administration

Most of ShellHub is scoped to a namespace. Administering the instance — every account, every namespace — is done from the host it runs on, with the admin commands built into the server binary. They write to the database directly, without going through the API.

Running a command

$ ./bin/cli user list

bin/cli runs the command inside the server container, so there is nothing separate to install. It refuses to run when the stack is down, with ShellHub is not running.

Users

Command Purpose
user create <username> <password> <email> Create a user
user password <username> <password> Change a user’s password
user delete <username> Delete a user
user list List all users 
$ ./bin/cli user create john_doe Secret123!- [email protected]

Add --admin to create the user as a superadmin. The flag applies at creation: there is no command that promotes an existing account. Usernames and emails are lowercased before they are stored, so two accounts cannot differ by case alone.

A superadmin administers the instance. It does not reach a device: an access policy still decides that, exactly as for anybody else.

Resetting a password

$ ./bin/cli user password john_doe NewSecret123!-

Password recovery by email is a Cloud capability. On a self-hosted instance this command is the recovery path, and it is the reason an operator needs shell access to the host.

Namespaces

Command Purpose
namespace create <namespace> <owner> [tenant] Create a namespace
namespace delete <namespace> Delete a namespace
namespace list List namespaces
namespace inspect <namespace> Show one namespace in full 
$ ./bin/cli namespace create engineering john_doe

The tenant identifier is optional; one is generated when it is omitted.

Flag Default Meaning
--type team The namespace type

Every namespace the CLI creates is new: identities and access policies decide SSH access, and devices enroll by pairing or a provisioning key. Only a namespace that predates identity-based access is legacy. See Upgrading a Legacy Namespace.

Deleting a namespace removes its devices, identities, policies and session records.

Members

Command Purpose
namespace member add <username> <namespace> <role> Add a member
namespace member remove <username> <namespace> Remove a member 
$ ./bin/cli namespace member add myuser mynamespace observer

The role is one of observer, operator, administrator or owner. Adding a member grants access to no device — a member reaches nothing until an access policy grants it. On Community this is also how the first member joins the one namespace, since invitations need mail the instance does not have.

Where to go next

esc