Accounts and remote administration

Overview and explanation

An account determines which parts of the administration interface a user can access and which operations they can perform. Routine content management, device configuration and maintenance operations have different purposes and effects.

Sign-in and permissions

• Sign-in: The reviewed portal uses a username and password.
• Permissions: Permissions distinguish operations and access scope, including access to the user’s own company and to other companies. Portal server handlers include permission checks for reading and changing device data and for other operations.
• MFA and SSO: Multi-factor authentication and federated SSO were not established in the reviewed sign-in path. This document therefore does not present them as verified features.

For the detailed breakdown, see Roles and permissions. Their names are consistent across the platform. Responsibilities within an organisation must be assigned using the permission combinations that are actually available.

Hiding a button or menu item does not, on its own, establish that permissions are enforced across all services.

Screen preview and maintenance console

Separate content access from service access according to responsibilities. Registration or licensing does not replace permission checks; the remote console allows changes to the device and is intended for authorised service users.

• Remote preview: Remote preview shows captured images from the player. The portal offers two capture modes; their scope and speed depend on the version and platform. During diagnosis, check what the preview actually shows rather than relying only on the mode label. It is not a recording of every played advertising spot.
• Remote Console: Remote Console provides an interface for maintenance commands on a connected device. Connector receives and executes commands and returns their output. This is not automatically an SSH session: commands pass through the system’s messaging layer.

Preview frame rate (FPS): the next image is requested after the previous one arrives. There is no fixed FPS setting; the result depends on capture, image processing, device performance and the network. It is separate from the playback frame rate on the screen.

The user interface makes the console available to the Server Administrator role and above. Independently checking permission for the specific device in the messaging layer is an important security control; it cannot be inferred from the interface restriction alone.

For the procedure, see Remote Console – How to Use It

SSH, VPN and maintenance access

• SSH: SSH is used to administer the operating system and is separate from normal portal access.
• VPN: A VPN may provide a maintenance connection between managed components.

Its deployment and authentication method must be assessed for the particular server or device.

The supplied portal host outputs confirm active UFW and Fail2ban rules for SSH. They also permit root login using a password or key. These outputs do not establish that the same settings apply to other servers.

• Maintenance account owner: Operational procedures identify the person responsible.
• Access scope: Procedures define the permitted maintenance work.
• Maintenance records: Procedures specify how maintenance actions are recorded.
• Access removal: Access is removed when authorisation ends.

Routine error logs or playback reports do not constitute a complete audit trail of user actions.

Registration and licensing

• Device registration: Registration assigns a device to the managed system and provides its configuration.
• Licence: A licence grants the right to use the service within the agreed scope.
• Access verification: Registration, licence validity and access verification serve different purposes; a licence does not replace request-level security checks.

For the procedure, see Register the player