Create an Administrator account on the Admin Interface

In order for any Administrators to access the Admin Interface, they need:

1. The auth-cookie for the Admin Interface’s ATHS

2. An account on the Admin Interface, which requires the following credentials to log in:

   • Username

   • Passphrase

   • Two-factor authentication code

You should create a separate account on the Admin Interface for each user who needs access. This makes it easy to enable or disable access to the Admin Interface on an individual basis, so you can grant access to new users or revoke access for users who have left the organization.

There are two types of accounts on the Admin Interface: admin accounts and normal accounts. Admin accounts are like normal accounts, but they are additionally allowed to manage (add, change, delete) other user accounts through the web interface.

You must create the first admin account on the Admin Interface by running a command on the Application Server. After that, the Administrator can create additional accounts through the web-based Admin Interface.

To create an admin account via the command line, SSH to the Application Server, then:

sudo -u www-data bash
cd /var/www/securedrop
./manage.py add-admin

Follow the prompts.

A secure diceware passphrase will be generated by manage.py. You will see output like this:

This Journalist's passphrase is: delivery propose requisite stunner dragonfly unstamped stowaway

Passphrases include the spaces between the words, but not leading or trailing whitespace. Be sure to save this passphrase in the appropriate KeePassXC database.

Once that’s done, you should open Tor Browser and navigate to the Admin Interface’s onion address. Verify that you can log in to the Admin Interface with the admin account you just created.

For adding more user accounts, please refer now to our Admin Interface Guide.

Note

You can now set a custom logo image on your web interfaces by following the Updating the logo image documentation.