Docs / Obsidian Remote / Administrators

The admin console

The admin console is the web page where you run your Obsidian Remote server: see who is connected, manage devices and people, set policies, and read the audit log. Open your server's address in a browser, for example https://remote.example.com:21114/, and sign in.

Signing in

Sign in with your user name and password; if your account has two-factor sign-in, the page also asks for the Authenticator code.

To stop guessing, the server limits failed sign-ins: 5 failures in 15 minutes for one user from one address blocks that address for that user, and 20 failures in an hour from anywhere lock the user until the hour is up (the audit log records it). If someone forgot their password, another administrator can set a new one on the Users page.

What you see

Administrators see every page, in groups on the left:

Other users see My devices (the devices they own and their group's), Address books and My account.

Dashboard

The dashboard shows the state of the server right now: devices online (and how many are offline), live sessions, relay throughput, the number of users and the server's version. Below that:

• Live sessions: the sessions passing through the server, each with a button to end it.
• Connect to a device: type an ID and click Connect to open it in the web viewer.
• Recent activity: the latest entries from the audit log.

Copy client config at the top copies the line PCs need to find this server (see Installing the server).

Live sessions

Every session the server is relaying right now: who is connected to which device, from where, what kind of session, for how long, and how much data it has carried. End session disconnects both sides at once.

Sessions that go directly between two PCs on the same network don't pass through the server, so they don't appear here. They appear in the audit log when they end, as reported by the PC.

Audit log

Everything that happened on the server, newest first. Choose what to show:

• Everything, Sessions, File transfers, Failed device passwords, Console sign-ins, Failed console sign-ins or Admin actions,
• and search by user, address, device or detail.

Export CSV downloads what you are looking at as a spreadsheet file.

Entries that a PC reported about a session the server didn't set up itself (a direct connection by address, for example) are marked as self-reported.

The audit log is kept for 365 days unless you change Keep the audit log for (days) in Server settings (0 keeps it forever). Older entries are removed once a day.

Server settings

General:

• Server name: shown on the console and the web viewer.
• Keep the audit log for (days): see above. The audit log also has a Blocked countries filter.
• Require sign-in before connecting (anonymous viewers are refused): when on, only people with a user on this server can connect, and only to the devices they may see (see Devices, users, groups and address books).
• Web viewer at /web/ (connect from a browser): turn it off if you don't use the web viewer.

Click Save settings.

Blocked countries: refuse connections and sign-ins from the countries you list - type two-letter codes separated by commas (IN, PK) or pick them from Add from the list; the names appear underneath so you can check. Applies to: Viewers (connecting from the app or the web viewer, the relay, and signing in to the console, the app or the web viewer; on by default) and Hosts (computers registering with this server; off by default). Someone refused sees Connections from your country are blocked by this server., and the audit log records it (filter Blocked countries). Addresses whose country isn't known - your own network, or before the country database has downloaded - are always allowed. The list starts empty; our hosted servers block IN and PK. You can't block the country you're signed in from. Click Save blocked countries.

The country data is IP Geolocation by DB-IP (free, CC BY 4.0, credited at the bottom of the menu): the server downloads it every month by itself. The card says which file is in use; without internet access, see Installing the server.

Client configuration shows the client config string, the server key, the address and the certificate (with its expiry date), with copy buttons. Give the string to the app (Settings > Network, This PC's server) or to the installer's SERVER property (see Rolling out to PCs). If the console warns that the address comes from how you opened it, set publicHost in server.json (see Installing the server).

My account

Your profile (user name, display name, email, role and group), Password to change your password, and Two-factor sign-in:

1. Click Set up.
2. Scan the QR code with an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password...), or type the key shown under it.
3. Type the code it shows and click Turn on.

From then on, signing in to the console, the app and the web viewer asks for a code. To turn it off, type a current code and click Turn off.

If you lose your phone, another administrator can clear your two-factor sign-in on the Users page (Reset two-factor). There is no way yet to do that from the server's command line, so make sure you have at least two administrators, each with two-factor sign-in.

Other pages

• Devices, Users, Groups and Address books: see Devices, users, groups and address books.
• Policies: see Policies.