Skip to content

User Management

Jump to bottom
Marc Pope edited this page Feb 3, 2026 · 1 revision

User Management

BBS supports multiple users with role-based access control. Admins can create users, assign roles, and control which clients each user can access.

User Roles

BBS has two user roles:

Admin

Permissions:

  • Full access to all BBS features
  • Can view and manage all clients (regardless of ownership)
  • Can create, edit, and delete users
  • Can access Settings page
  • Can update BBS and agents
  • Can create and manage backup templates
  • Can view all jobs in Queue

Use Cases:

  • System administrators
  • Backup administrators
  • MSP technicians managing all customer backups

User (Regular User)

Permissions:

  • Can only view and manage assigned clients
  • Cannot access Settings page
  • Cannot create or manage other users
  • Cannot update BBS server (can update agents for owned clients)
  • Can view only jobs related to their clients
  • Can configure plugins and backup plans for their clients

Use Cases:

  • Individual customers in an MSP environment
  • Departmental administrators (only see their department's servers)
  • Limited-access backup operators

Managing Users

Accessing User Management

Navigate to user management via:

  • Settings → Users section (admins only)
  • Or direct URL: /users

Screenshot: User management page showing list of users

User List

The user list displays:

Column Description
Username Unique username for login
Email User's email address
Role Admin or User
Clients Number of clients assigned to this user
2FA Whether 2FA is enabled (lock icon)
Last Login Last successful login timestamp
Actions Edit, Delete buttons

Creating a User

Step-by-Step

  1. Click Add User button
  2. Fill in the user creation form:
    • Username: Unique username (alphanumeric, dashes, underscores)
    • Email: Valid email address
    • Password: Strong password (min 8 characters)
    • Confirm Password: Must match password
    • Role: Select Admin or User
    • Timezone: User's local timezone for timestamp display
  3. Click Create User

Screenshot: User creation form

Username Requirements

  • Length: 3-50 characters
  • Characters: Letters, numbers, dashes, underscores (no spaces)
  • Uniqueness: Must be unique across all users
  • Case: Case-insensitive (cannot have both "john" and "John")

Password Requirements

  • Minimum Length: 8 characters
  • Recommended: Use strong passwords with mix of uppercase, lowercase, numbers, symbols
  • Storage: Passwords are hashed with bcrypt (never stored in plain text)

Email Requirements

  • Must be valid email format
  • Used for email notifications (if SMTP configured)
  • Can be changed by user in Profile
  • Not required to be unique (but recommended)

Timezone

  • Used to display timestamps in user's local time
  • Defaults to server timezone if not specified
  • Can be changed by user in Profile

Editing a User

Modifying User Details

  1. Click the Edit button next to a user
  2. Modify any field:
    • Email
    • Role (promote to admin or demote to user)
    • Timezone
    • Password (leave blank to keep unchanged)
  3. Click Save

Screenshot: User edit form

Changing User Role

Promoting to Admin:

  • Change role from "User" to "Admin"
  • User gains access to all features and clients
  • Client assignments are preserved but no longer enforced

Demoting from Admin:

  • Change role from "Admin" to "User"
  • User loses access to Settings and unassigned clients
  • Assign clients to the user or they will have no access

Resetting User Password

Admin Can Reset:

  1. Edit the user
  2. Enter a new password in the Password field
  3. Confirm password
  4. Save
  5. Inform the user of the new password

User Can Self-Reset:

  • Users can change their own password at /profile

Deleting a User

Delete Process

  1. Click the Delete button next to a user
  2. Confirm deletion
  3. BBS handles client ownership:
    • Option A: Reassign the user's clients to another user
    • Option B: Remove client ownership (clients become unassigned, accessible only by admins)
  4. User is permanently deleted

Screenshot: User deletion confirmation dialog with client reassignment options

Important Notes

  • Cannot Delete Self: You cannot delete your own user account
  • Cannot Delete Last Admin: At least one admin must exist
  • Client Reassignment: Choose carefully when reassigning clients
  • Permanent: User deletion cannot be undone

Client Ownership

Assigning Clients to Users

Method 1: From User Management:

  1. Edit a user
  2. In the Assigned Clients section, check the clients this user should access
  3. Save

Screenshot: User edit form with client assignment checkboxes

Method 2: From Client Detail:

  1. Go to client detail page
  2. Click Settings tab
  3. Change Owner dropdown to the desired user
  4. Save

Screenshot: Client settings tab with owner dropdown

Ownership Rules

  • Admin Users: Can see all clients regardless of ownership
  • Regular Users: Can only see clients assigned to them
  • Unassigned Clients: Only visible to admins
  • Multiple Ownership: Not supported (each client has one owner or none)

Transferring Client Ownership

To transfer a client from one user to another:

  1. Edit the client's settings
  2. Change the Owner dropdown to the new user
  3. Save
  4. Original owner loses access (unless they are an admin)
  5. New owner gains full access

User Profile

Each user can manage their own profile settings.

Accessing Profile

  • Click username in top-right corner → Profile
  • Or navigate to /profile

Screenshot: Profile page showing user settings

Profile Settings

Users can modify:

Setting Description
Email Update email address
Password Change password (requires current password)
Timezone Change local timezone for timestamp display
2FA Enable/disable two-factor authentication
Notification Preferences Email notification settings (per-user)

Changing Email

  1. Go to Profile
  2. Update Email field
  3. Click Save
  4. Email is updated immediately
  5. Future notifications will use the new email

Changing Password

  1. Go to Profile → Change Password section
  2. Enter Current Password
  3. Enter New Password (min 8 characters)
  4. Confirm New Password
  5. Click Save
  6. Session remains active (no re-login required)

Security:

  • Current password is required (prevents unauthorized password changes)
  • Passwords are never shown in plain text
  • Use a strong, unique password

Timezone Settings

  1. Go to Profile
  2. Select Timezone from dropdown
  3. Click Save
  4. All timestamps are now displayed in the selected timezone

Common Timezones:

  • America/New_York (EST/EDT)
  • America/Los_Angeles (PST/PDT)
  • Europe/London (GMT/BST)
  • Asia/Tokyo (JST)
  • UTC (Universal Time)

Two-Factor Authentication

Users can enable 2FA for additional account security.

Enabling 2FA in Profile

  1. Go to Profile → Two-Factor Authentication tab
  2. Click Enable 2FA
  3. Scan QR code with authenticator app
  4. Enter 6-digit code to verify
  5. Save recovery codes

See Two-Factor-Authentication for detailed 2FA setup and usage.

Notification Preferences

Users can customize which notifications they receive via email.

Configuring Notification Preferences

  1. Go to Profile → Notifications tab
  2. Toggle notification types:
    • Backup Failed
    • Agent Offline
    • Storage Low
    • Missed Schedule
  3. Configure digest mode (optional):
    • Individual Emails: Receive separate email for each notification
    • Daily Digest: Receive one email per day summarizing all notifications
  4. Set digest time (e.g., 8:00 AM)
  5. Save

Screenshot: Profile notification preferences

Note: Admin must configure SMTP settings (Settings → Email) before users can receive email notifications.

Force Two-Factor Authentication

Admins can require all users to enable 2FA.

Enabling Force 2FA

  1. Navigate to Settings → General tab
  2. Check Force Two-Factor Authentication
  3. Save

Behavior:

  • Users without 2FA are redirected to 2FA setup after login
  • Users cannot access BBS until 2FA is enabled
  • Existing sessions remain valid until logout
  • Admins can still emergency-reset 2FA via CLI

See Two-Factor-Authentication for details.

User Activity Tracking

BBS tracks user login activity for security and auditing.

Last Login Timestamp

  • Displayed in user list
  • Updated on every successful login
  • Visible to admins only

Failed Login Attempts

  • Tracked per-user
  • Rate limiting after 5 failed attempts (10 minute lockout)
  • Automatic unlock after timeout

Session Management

  • Sessions expire after configured timeout (default: 720 hours)
  • Admins can view active sessions (future feature)
  • Users can log out manually (invalidates session immediately)

Multi-Tenant Usage

BBS is designed to support multi-tenant environments (MSPs, hosting providers).

MSP Configuration

Scenario: Managed Service Provider with multiple customers

Setup:

  1. Create one user per customer
  2. Assign role: User (not admin)
  3. Create clients for customer's servers
  4. Assign all customer's clients to their user account
  5. Customer logs in and sees only their servers

Benefits:

  • Isolation: Customers cannot see each other's data
  • Self-Service: Customers can manage their own backups
  • Centralized Management: MSP admins can see all clients
  • Branding: Each user sees only their own servers

Department Isolation

Scenario: Large organization with multiple departments

Setup:

  1. Create one user per department administrator
  2. Assign clients to department admins
  3. Department admins manage their own backup plans

Example:

  • IT Department: Owns clients: db-server-01, app-server-01
  • Finance Department: Owns clients: finance-server-01, erp-server-01
  • HR Department: Owns clients: hr-server-01, payroll-server-01

Best Practices

User Creation

  • Unique Usernames: Use clear, descriptive usernames (e.g., "john.smith" not "user123")
  • Strong Passwords: Enforce strong password policy
  • Email Addresses: Use work emails, not personal emails
  • Timezones: Set correct timezone for accurate timestamp display

Role Assignment

  • Limit Admins: Only grant admin role to trusted personnel
  • Principle of Least Privilege: Regular users should only see their own clients
  • Review Periodically: Audit user roles and access quarterly

Client Ownership

  • Assign All Clients: Avoid unassigned clients (only admins can see them)
  • Document Ownership: Keep records of which user owns which clients
  • Transfer Carefully: When employees leave, reassign their clients before deleting user

Security

  • Enforce 2FA: Enable "Force 2FA" for production environments
  • Session Timeouts: Use shorter timeouts (24-48 hours) for high-security environments
  • Password Rotation: Encourage users to change passwords periodically
  • Deactivate Quickly: Delete or disable user accounts immediately when access should be revoked

Multi-Tenant

  • Naming Convention: Use customer names in client hostnames (e.g., "acme-web-01")
  • User = Customer: One user account per customer for easy isolation
  • Admin Access: MSP admins should have admin role, customers should be regular users
  • Documentation: Provide user guides for customers on how to manage their backups

Troubleshooting

Cannot Create User

Error: "Username already exists"

Solution: Choose a different username (usernames are unique)

Error: "Email is invalid"

Solution: Verify email format (must be valid email address)

Error: "Password too weak"

Solution: Use at least 8 characters (longer is better)

User Cannot Log In

Possible Causes:

  • Incorrect username or password
  • Account disabled
  • 2FA code incorrect (if 2FA enabled)
  • Too many failed login attempts (rate limited)

Solutions:

  • Verify username and password are correct
  • Admin can reset user password
  • Wait 10 minutes if rate limited
  • Use recovery code if 2FA authenticator is lost

User Cannot See Clients

Possible Causes:

  • No clients assigned to user
  • User is regular user (not admin) and clients are unassigned

Solutions:

  • Admin assigns clients to the user
  • Or promote user to admin role (can see all clients)

User Cannot Access Settings

Cause: User is not an admin

Solution: Only admins can access Settings page. Promote user to admin role if necessary.

Deleted User's Clients Inaccessible

Cause: Clients were not reassigned before user deletion

Solution:

  • Clients are now unassigned
  • Admin can access them (admins see all clients)
  • Admin should reassign clients to active users

Related Documentation

📖 User Manual

Getting Started

Using BBS

Monitoring

Administration

Reference

Clone this wiki locally