Root, the system administrator

YTCC has two kinds of accounts. The root account is the system administrator of the server and the designer of all its projects. Project users are defined in each project and operate it on the runtime screen.

Account	What it may do
root	Everything, in every project: create, import, copy, rename, back up and delete projects, manage collections, work in the screen editor and the configuration editor, manage the users, profiles and policies of a project, change the project phase, start and stop projects, and every action on the runtime screen. Also the actions that belong to the whole server: ports and the fixed YTCC processes, shared images, offline map packages, the shared electrical symbol library and the Server keys for AI access.
Project user	The runtime screen, with the permissions of their profiles, and starting, stopping and restarting the project if a profile has System stop.

Root is not a user of any project. Its rights come from the server account, so a profile cannot give them and a project cannot take them away. In a project with user login off, nobody signs in, root included, and everyone has every permission in that project; see Permission model.

These permissions belong to root alone, whatever the profiles of project users say: Editor access, Configuration editing, User management, Project phase, AI access (MCP) and DNP3 administration. The configuration editor does not open for a project user; it shows its sign-in panel, where root can sign in.

The root account comes from one of two places:

• On a new server, the first-run setup creates it. The account you create there is the root account, whatever user name you give it.
• On a server upgraded from an earlier version, YTCC creates it with the user name root and the password root; see Upgraded servers.

Before you begin

• You know the user name and the password of the root account.

Steps

1. Sign in as root

On the home page, click the session button at the top right (Not signed in) and then Login. The Login Required window opens with root in Username. Change the user name if your root account has another one, enter the Password and click Sign In. There is no project to choose: the sign-in goes to the server account.

Until root signs in, the home page shows only what a project user may do: the runtime screen and starting, stopping and restarting a project. New Project, Collection, Import, Back up, Open editor, Drawing editor, Configuration and the design commands of the project menu appear after the sign-in.

The sign-in windows of the screen editor, the configuration editor and the runtime screen also accept the root user name and password. When you start or stop a project without a session, the project's sign-in window has the link Sign in as root (system administrator).

2. Check the session

Click the session button again. The menu shows the user name, Server account and Server administrator, and the items Change password, Switch user and Exit.

If root still has the default password root, or a password that does not meet the server rule, a yellow band at the bottom left of the window says Default root password (root / root) is in use or The root password does not meet the security rule. The band cannot be closed. It appears on the home page and on the runtime screen while root is signed in; the screen editor and the configuration editor do not show it. On the home page it has the link Change password. A visitor who is not signed in as root does not see it.

One sign-in is enough for this browser:

• The editors you open from the home page, and the YTCC tabs that are already open, take over the root session and do not ask again. Sign-in windows that are open in other tabs close by themselves.
• A tab where a project user signed in keeps that user, so that their commands stay under their name. A tab that signed in automatically does not take over root from other tabs either.
• Reloading the page keeps the session. A tab that was closed and opened again later asks again.
• Another browser or another computer needs its own sign-in.
• Exit or Switch user in a tab where root is in effect ends the root session in every tab of the browser. After 30 minutes without activity the session of that tab ends (see Sessions).

3. Let project users operate

Project users sign in to the runtime screen with their own accounts; see Open the runtime screen and sign in. Commands, approvals and alarm acknowledgements are recorded with their names. What root does in a project is recorded with the root user name.

Starting, stopping and restarting a project from the home page needs System stop in the project, or root. Each start and stop is written to the project's event list as Project start or Project stop, with the user and the computer. A user without the permission cannot start or stop the project.

In a four-eyes approval, the approving second user is always a project user with Approve commands (four eyes); root can request a command but cannot approve one.

Result

You are signed in as root in this browser and can design, manage and operate every project. Project users work only on the runtime screen.

Change the root password

Change the password on the home page:

1. Click the session button and Change password. The window Change root password opens.
2. Enter the Current password, the New password and the New password (repeat).
3. Leave Strong password required selected. The new password then needs at least 12 characters, an uppercase letter, a lowercase letter and a digit, and must not contain the user name. If you clear the box, any password is accepted; the window warns Weak passwords are not recommended in the field (IEC 62443); this choice is recorded in the audit log.
4. Click Change password.

Changing the password closes every root session, also in other browsers. The window Password changed; sign in with the new password. opens; sign in again. A wrong current password counts as a failed sign-in and can lock the account.

Upgraded servers

When the projects server starts after an upgrade and finds no server account, but a project already has user login or the server has a list of server administrators from an earlier version, it creates the root account with the user name root and the password root. From then on root alone designs and administers. Users who designed screens or managed users before can only operate their projects.

Sign in as root with the password root and change the password at once. Until you do, every root sign-in shows the yellow band and is marked in the audit log of the server account. Change it before the server is connected to the plant network.

A server where no project has user login shows the first-run setup instead, like a new server.

Recover the root account

If the root password is lost or the account is locked, reset it on the server with scada-manager server-user. It works while YTCC runs or when it is stopped:

.\scada-manager server-user reset
.\scada-manager server-user reset --user <name>
.\scada-manager server-user list

reset asks for the new password twice without showing it. It also unlocks the account, clears the failed attempts, enables the account, ends its open sessions and writes the reset to the audit log of the server account. The new password applies at once, without a restart. The command warns about a weak password but accepts it; change it afterwards on the home page. Use --user when your root account has a user name other than root. list shows each server account with its state, whether it is locked and when its password was changed.

If the command cannot be used: stop YTCC, move the files auth\_srv.json and auth\_srv.sessions.json out of the data folder of the projects server and start YTCC again. If a project has user login, the root account is created again with the password root; change it at once. If no project has user login, the first-run setup opens again.

caution

The files in the auth folder hold the user accounts of the server and of every project. Keep a copy of a file before you move it, and protect the data folder against access by other users of the server.

Good to know

• Five wrong passwords in a row lock the root account for 15 minutes. The server also accepts at most 10 failed sign-in attempts in 10 minutes for the same user name.
• Sign-ins, sign-outs, password changes and the first-run setup are written to the audit log of the server account. Sign-ins with the default or a weak password are marked there.