From 9610fc66d30faea534b1476d8f245b07b0e7fe06 Mon Sep 17 00:00:00 2001
From: D Stephenson <dcstephenson@gmail.com>
Date: Tue, 18 Aug 2026 11:39:13 -0500
Subject: [PATCH] Use dedicated RADIUS credentials for Web Access Control SSH
 login

Switches authenticate SSH via RADIUS (aaa authentication login ssh
radius local), which is separate from the local admin account used
for the HTTPS GUI and baked into generated configs. Web Access
Control (HTTPS enable/disable and Disable Telnet) was reusing that
local admin credential (or per-switch NocoDB creds) for its SSH
connection, which is the wrong credential pair.

Adds a dedicated SSH Credentials (RADIUS) section in Settings and a
getSshCredentials() helper that Web Access Control uses exclusively,
plus an upfront error toast if those fields are left blank.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CLfUJoQTaUePx1m1d2v2j9
---
 templates/index.html | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/templates/index.html b/templates/index.html
index 326fe45..789fc20 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -741,6 +741,23 @@
           </div>
         </div>
 
+        <div style="margin-bottom:10px">
+          <div class="section-label" style="margin-bottom:6px">SSH Credentials (RADIUS)</div>
+          <div class="settings-grid">
+            <div class="setting-item full">
+              <span class="setting-label">SSH USERNAME</span>
+              <input type="text" id="s-ssh-username" value="">
+            </div>
+            <div class="setting-item full">
+              <span class="setting-label">SSH PASSWORD (plaintext)</span>
+              <input type="text" id="s-ssh-password" value="">
+            </div>
+          </div>
+          <div style="font-size:11px;color:var(--muted);margin-top:4px">
+            Used for the SSH login in Web Access Control (switches authenticate SSH via RADIUS, not the local admin account above).
+          </div>
+        </div>
+
         <div style="margin-bottom:10px">
           <div class="section-label" style="margin-bottom:6px">SNMP &amp; RADIUS</div>
           <div class="settings-grid">
@@ -928,6 +945,8 @@ function cfg() {
     gateway:      document.getElementById('s-gateway').value.trim(),
     defaultUsername: document.getElementById('s-username').value.trim(),
     defaultPassword: document.getElementById('s-password').value.trim(),
+    sshUsername: document.getElementById('s-ssh-username').value.trim(),
+    sshPassword: document.getElementById('s-ssh-password').value.trim(),
     engineId:     document.getElementById('s-engine-id').value.trim(),
     radius:       document.getElementById('s-radius').value.trim(),
     snmpSwitchmonAuth: document.getElementById('s-snmp-switchmon-auth').value.trim(),
@@ -1285,11 +1304,15 @@ function getWaTargetSwitches() {
   return switches; // all
 }
 
-function getCredentials(sw) {
+// SSH login to the switches goes through RADIUS, not the local admin
+// account used for the HTTPS GUI / baked into generated configs — so
+// Web Access Control uses its own credential fields, not per-switch
+// NocoDB creds or the DEFAULT USERNAME/PASSWORD settings.
+function getSshCredentials() {
   const c = cfg();
   return {
-    username: (sw.Username || '').trim() || c.defaultUsername || 'admin',
-    password: (sw.Password || '').trim() || c.defaultPassword || '',
+    username: c.sshUsername,
+    password: c.sshPassword,
   };
 }
 
@@ -1324,7 +1347,7 @@ async function runWithConcurrency(tasks, concurrency, onStart, onDone) {
 }
 
 async function sendWebAccess(sw, action) {
-  const creds = getCredentials(sw);
+  const creds = getSshCredentials();
   const res = await fetch('/api/web-access', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -1371,6 +1394,12 @@ async function runWaOperation(action) {
     return;
   }
 
+  const sshCreds = getSshCredentials();
+  if (!sshCreds.username || !sshCreds.password) {
+    showToast('Set SSH USERNAME / SSH PASSWORD (RADIUS) in Settings first', 'err');
+    return;
+  }
+
   btnWaEnable.disabled  = true;
   btnWaDisable.disabled = true;
   btnWaDisableTelnet.disabled = true;