PiKVM comes with the following default passwords:
- Linux admin (SSH, console, etc.): user
- PiKVM Web Interface, API, VNC...: user
admin, no 2FA code.
These are two separate entities with independent accounts.
To change passwords, you will need to use the terminal access via SSH or Web Terminal.
If you are using the Web Terminal, use the
su - command to get root access (enter the root user password).
Changing the Linux password¶
# rw # passwd root # ro
Changing the KVM password¶
# rw # kvmd-htpasswd set admin # ro
Please note that admin is the default user. It is possible to create several different users with different passwords to access the Web UI, but keep in mind that they all have the same rights:
# kvmd-htpasswd set <user> # Sets a new user with password # kvmd-htpasswd del <user> # Removes/deletes a user
This is a new method of strengthening the protection of PiKVM, available since
KVM >= 3.196.
It is strongly recommended to enable it if you expose the PiKVM in the big and scary Internet.
Using 2FA eliminates the possibility of using IPMI and VNC with vncauth (not used by default). It also slightly affects the use of API and regular VNC with user/password, read below.
Steb-by step to enable 2FA:
rw && pacman -Syu && reboot.
Make sure that NTP is running otherwise you will not be able to access (
timedatectlcommand). The timezone doesn't matter.
Install Google Authenticator app to your phone (iOS, Android). It will generate one-time access codes.
Create a secret for one-time codes on PiKVM:
rw kvmd-totp init ro
Run Google Authenticator and scan the QR code.
Now, on the PiKVM login page, you will need to add 6 digits to the 2FA code field.
Now all Web UI users will be required to enter a one-time password. In other words, the secret is the same for all users.
With 2FA for API or VNC authentication, you will need to add the one-time code to the password without spaces.
That is, if the password is
foobar and the code is
123456, then you need to use
foobar123456 as the password.
To view the current QR code of the secret use
To disable 2FA, use