97 lines
4.4 KiB
Plaintext
97 lines
4.4 KiB
Plaintext
|
---
|
||
|
|
title: Users & delegated access
|
||
|
|
description: Create sub-users, delegate panel access, and manage SFTP/SSH users at the server level.
|
||
|
|
sidebar:
|
||
|
|
order: 5
|
||
|
|
badge:
|
||
|
|
text: Draft
|
||
|
|
variant: caution
|
||
|
|
---
|
||
|
|
|
||
|
|
import { Aside } from '@astrojs/starlight/components';
|
||
|
|
import SuperAdmin from '~/content/partials/super-admin-callout.mdx';
|
||
|
|
import Draft from '~/content/partials/draft-callout.mdx';
|
||
|
|
import SignIn from '~/content/partials/signing-in.mdx';
|
||
|
|
import Support from '~/content/partials/support-link.mdx';
|
||
|
|
|
||
|
|
<SuperAdmin />
|
||
|
|
|
||
|
|
<Draft />
|
||
|
|
|
||
|
|
WHP super admin lets you give other people scoped access to the server — your dev team, a contractor, or a junior admin — without sharing your own credentials.
|
||
|
|
|
||
|
|
## Three kinds of access
|
||
|
|
|
||
|
|
| Type | What they can do | Where they sign in |
|
||
|
|
| ------------------- | -------------------------------------------------------------------------------- | --------------------------------------- |
|
||
|
|
| **WHP sub-user** | Sign in to WHP with their own credentials. You control which sections they see. | Same `:8443` URL as you. |
|
||
|
|
| **Delegated panel access** | A read-only or scoped-write view onto a specific site, for a contractor. | Same WHP, but scoped to that one site. |
|
||
|
|
| **SFTP / SSH user** | File access (and optionally SSH) without WHP at all. | SFTP client / SSH terminal. |
|
||
|
|
|
||
|
|
## Sign in to WHP
|
||
|
|
|
||
|
|
<SignIn />
|
||
|
|
|
||
|
|
## Create a WHP sub-user
|
||
|
|
|
||
|
|
<Aside type="tip">
|
||
|
|
WHP sub-users are the right model when someone needs to manage parts of the server alongside you. Use **delegated access** instead if they only need one site, or **SFTP/SSH** if they only need files.
|
||
|
|
</Aside>
|
||
|
|
|
||
|
|
1. Open **Users → WHP Users → Add User** in the admin sidebar.
|
||
|
|
2. Set a username, a strong password, and an email (used for password reset and 2FA).
|
||
|
|
3. Choose a **role**: pick from the predefined roles (Admin, Site Manager, Read-only, etc.) or build a custom role with specific pages enabled.
|
||
|
|
4. (Optional) Enable **Require 2FA** so they have to set up an authenticator app on first login.
|
||
|
|
5. Save. Share the credentials with them out-of-band; don't email passwords.
|
||
|
|
|
||
|
|
## Delegated access for a single site
|
||
|
|
|
||
|
|
Use the customer-facing **Delegated Users** page (sidebar → **Delegated Users**, available on every account) when a contractor only needs to work on one site:
|
||
|
|
|
||
|
|
1. Open **Delegated Users → Add**.
|
||
|
|
2. Pick the site they should have access to.
|
||
|
|
3. Set their permission scope: view-only, manage-files, manage-DNS, etc.
|
||
|
|
4. Send them the panel URL. They sign in with their own credentials and see only that site.
|
||
|
|
|
||
|
|
This is the right path for, say, a freelance designer who needs to upload assets but shouldn't see your other sites or your DNS.
|
||
|
|
|
||
|
|
## SFTP / SSH users
|
||
|
|
|
||
|
|
Pure file access without WHP. Created from the admin **Users → SFTP/SSH** page:
|
||
|
|
|
||
|
|
1. Open **Users → SFTP/SSH → Add**.
|
||
|
|
2. Set the username, password (or paste their public SSH key), and which directories they have access to.
|
||
|
|
3. Pick whether to grant interactive SSH or restrict to SFTP only.
|
||
|
|
4. Save. They can now connect with their preferred SFTP/SSH client.
|
||
|
|
|
||
|
|
<Aside type="caution">
|
||
|
|
Interactive SSH is powerful — anyone with it can run arbitrary commands inside the container or VM. Restrict to SFTP-only unless they specifically need a shell.
|
||
|
|
</Aside>
|
||
|
|
|
||
|
|
## Managing existing users
|
||
|
|
|
||
|
|
The user list shows last sign-in, role, and 2FA status. Common actions from each user's row:
|
||
|
|
|
||
|
|
- **Disable** — keeps the user but blocks sign-in.
|
||
|
|
- **Delete** — removes the user.
|
||
|
|
- **Force password reset** — invalidates their current password; they receive an email link.
|
||
|
|
- **Revoke sessions** — kicks them out of any active panel sessions immediately.
|
||
|
|
|
||
|
|
When someone leaves your team, **revoke sessions first** (so they're out *now*), then disable or delete the user.
|
||
|
|
|
||
|
|
## Troubleshooting
|
||
|
|
|
||
|
|
**Sub-user can sign in but the page they expect is missing.** Their role doesn't include that section. Edit the role and tick the right page.
|
||
|
|
|
||
|
|
**SFTP user can connect but uploads land in the wrong directory.** Check their **Home directory** in the SFTP/SSH user page — it determines what they see as `/`.
|
||
|
|
|
||
|
|
**A delegated user can't see DNS records.** Delegated access defaults to file-only. Edit their permissions to include DNS Management.
|
||
|
|
|
||
|
|
## Related
|
||
|
|
|
||
|
|
- [Server settings & services](/whp/admin/server-settings/)
|
||
|
|
|
||
|
|
## Still stuck?
|
||
|
|
|
||
|
|
<Support />
|