Feature

Who may reach this board

in this fork since v2.28.0

There are two ways into a board running this firmware: a local password, and a proxy holding a certificate the board trusts. Neither used to be visible from the interface, nor changeable there.

2ways in, both now visible

12characters minimum, counted as characters

0passwords written to the audit log

the daemon as shipped in bmcd 2.36.3, 2026-09-12.

See it in the demo →The Security page, from captured data.Do it on your board →Install the firmware that carries these controls.The evidence →Including that anything local is still trusted without a credential.A certificate that does not rot →The certificate the board serves on that connection.

The Security page: the password for the local account, the board's certificate, and the trusted proxy it will accept an operator's name from.

The argument

These take a JSON body on their own path rather than joining the legacy interface, because every mutating call there is recorded with its whole query string -- which would put a password in a log file, in clear, for ever. What is logged is the action and the actor, never the secret. The current password is required even from an operator a proxy vouched for.

The full argument, with every measurement →