Device Credentials#

Device credentials separate authentication data from connection and inventory metadata.

A single credential can be referenced by multiple saved or temporary connections. This avoids copying usernames, authentication material, and Enable secrets into every target definition.

#Credential model

Each credential contains:

• a unique name using letters, numbers, _, ., or -
• a required SSH login username and one authentication method: password, encrypted inline private key, runtime private-key file, or SSH agent
• an optional private-key passphrase
• an optional Enable stage
• an optional Enable secret; when Enable is active without a secret, rauto submits Enter at the prompt

Saved connections store only a stable credential_id reference. Credential query output exposes metadata and secret-presence flags, never plaintext secrets or encryption references.

#Create and inspect credentials

Create a credential interactively so secrets do not appear in shell history:

rauto credential add network-admin

You can also provide explicit fields when automation requires them:

rauto credential add network-admin \
  --login-username netops \
  --login-secret '<login-secret>' \
  --enable \
  --enable-secret '<enable-secret>'

rauto credential add linux-inline-key \
  --login-username root \
  --auth-type private-key \
  --private-key ~/.ssh/id_ed25519

rauto credential add linux-runtime-key \
  --login-username root \
  --auth-type private-key-file \
  --private-key-file /run/secrets/id_ed25519

rauto credential add automation-agent \
  --login-username automation \
  --auth-type agent

Inspect stored metadata:

rauto credential list
rauto credential show network-admin
rauto credential list --json

#Update and delete

rauto credential update network-admin --name network-ops
rauto credential update network-ops --enable
rauto credential update network-ops --disable-enable
rauto credential delete network-ops

Omitting --login-secret during an update preserves the current login secret. An enabled credential can use a stored Enable secret or an empty-Enter Enable flow.

A credential referenced by one or more connections cannot be deleted until those references are removed. The Web credential workspace shows the referencing connection names.

#Bulk import

Import credentials from CSV or Excel with name-based upsert:

rauto credential import ./credentials.csv
rauto credential import ./credentials.xlsx --json

Supported formats are .csv, .xlsx, .xls, .xlsm, and .xlsb.

Recommended columns:

name,login_username,auth_type,login_secret,private_key,private_key_path,passphrase,enable_secret,enable_enabled
network-admin,netops,password,replace-with-login-secret,,,,replace-with-enable-secret,true
linux-runtime-key,root,private_key_file,,,/run/secrets/id_ed25519,,,false

New rows require name, login_username, and the fields required by auth_type. For existing credentials, blank authentication fields preserve stored values when the type is unchanged. A blank enable_secret clears the saved Enable secret. Boolean values accept true/false, 1/0, yes/no, or 是/否.

Import files contain plaintext secrets. Protect or remove them after import. Reports include row numbers, names, counts, and validation errors, but never return secrets.

#Use credentials with targets

Direct targets reference a credential by name or stable ID:

rauto connection test \
  --host 192.168.1.1 \
  --credential network-admin \
  --device-profile cisco_ios

rauto exec "show version" \
  --host 192.168.1.1 \
  --credential network-admin

Save the reference as part of a reusable connection:

rauto connection add core-sw-01 \
  --host 192.168.1.1 \
  --credential network-admin \
  --ssh-security balanced \
  --device-profile cisco_ios

Commands that use --connection core-sw-01 resolve the referenced credential only in memory.

#Web credential workspace

The Web console provides a dedicated Credentials page for:

• searching credentials by name, username, or referencing connection
• creating and updating authentication records
• enabling or disabling the Enable stage
• reviewing references before deletion
• importing CSV or Excel files and downloading a starter template
• creating a credential without leaving a connection editor

#Storage and backup behavior

Passwords, inline keys, and passphrases are encrypted in ~/.rauto/rauto.db; the master key lives in the operating system keyring. Private-key-file records keep only the path and read it at connection time. SSH-agent records use the agent available to the rauto process.

Backup archives include the database ciphertext but do not export the local keyring master key. After restoring on another machine or OS account, edit and save affected credentials again, or migrate the same master key through an approved platform-specific process.