Account selection

When you launch a feature in a work session—such as the web terminal (Websh), file transfer (WebFTP), or editor—you connect to the remote server as a specific account. Which account is available depends on the server’s operating system.

My account (Linux servers)

On Linux servers (Debian and Red Hat family), you always connect as your own account—your Alpacon username is used as the remote user. There is no system-account selection on Linux.

All users who meet the access requirements can connect with their own account.

For privileged actions on Linux, use sudo with MFA rather than logging in as another account. See sudo with MFA.

System accounts (Windows and macOS servers)

On Windows and macOS servers, users with sudo privilege can also select a system account on the server when connecting. The list shows accounts that have shell access on the server.

Note: The root account appears in the system accounts list only when Allow direct root access is enabled in server access policies. This setting is off by default; while it’s off, use sudo with MFA for root-level actions instead.

Who has sudo privilege:

  • Workspace Staff or Superuser: on all servers
  • Manager or Owner of a group that is assigned to the server

MFA authentication for system account access

When the MFA required actions setting is enabled in workspace authentication settings, connecting with a system account (on Windows or macOS) requires additional MFA verification.

Web (Alpacon console)

  1. Select a system account and click Connect
  2. A notification appears indicating MFA is required
  3. You are redirected to the MFA authentication page
  4. Complete authentication (TOTP, email, phone, or WebAuthn)
  5. After successful verification, you are automatically redirected back and the connection starts

CLI (alpacon websh / alpacon exec)

When using the CLI, the MFA flow differs from the web:

  1. The CLI displays an MFA authentication link
  2. Open the link in your browser and complete MFA verification
  3. The CLI automatically detects successful authentication and continues the operation
  4. The MFA link expires after 3 minutes—retry the command to receive a new link if it expires
$ alpacon websh my-server

MFA authentication required. Please visit:
https://app.alpacon.io/mfa/verify?token=abc123

Waiting for MFA authentication...

MFA timeout

MFA verification remains valid for a configured duration after completion. The timeout range is set by workspace administrators in Authentication, and individual users can adjust their own timeout within this range from security settings. Subsequent system account connections within the valid period will not require re-authentication.

Last updated: