Sensor Features

Secure Mode

Open in Claude

Note: Secure Mode is available in firmware v4.0 or later only.

Use this guide to configure secure mode on the sensor.

By default, the sensor can be configured without authentication. With Secure Mode turned on the sensor can only be configured after successful authentication.

Secure Mode Terminology

Reset Policy Can be set to either relaxed or strict. Setting the Reset Policy to relaxed is meant to be used for development purposes. In production setting the Reset Policy to strict is recommended.

RBAC Roles Secure Mode includes three roles: Guest, Operator, Admin. The Guest role can read all parameters of the sensor configuration. The Operator role can configure all parameters of the sensor configuration except uploading firmware updates and disabling Secure Mode. The Admin role can do everything the Operator role can do and update the firmware of the sensor and disable Secure Mode.

HTTP redirect When true (default), HTTP :80 redirects to HTTPS while Secure Mode is active. When false, HTTP and HTTPS are both served so existing API clients are not broken.

Generate Passwords The sensor is equipped with a True Random Number Generator (TRNG), which can be used to generate strong random passwords.

Enabling Secure Mode

Secure Mode can be enabled using the web interface or the HTTP API.

Web Interface

  1. Open the sensor web interface.
  2. Go to Configuration > System.
  3. In Security (Secure Mode), click on Enable Secure Mode.
  4. On the first page of the Enable Secure Mode wizard, choose a Reset Policy and click on Next.
  5. On the second page of the Enable Secure Mode wizard, choose your passwords or let the sensor generate passwords for the Admin and Operators roles and then click the Enable Secure Mode button.
  6. On the third and last page of the Enable Secure Mode wizard, the sensor will provide the Admin and Operator passwords - Save these passwords now!

HTTP API

Command

$curl https://os-992623000385.ouster.internal/api/v1/auth/secure-mode/enable \
>  --request POST \
>  --header 'Content-Type: application/json' \
>  --data '{
>  "reset_policy": "relaxed",
>  "http_redirect": true,
>  "generate": true,
>  "include_operator": true,
>  "passwords": {
>    "admin": "",
>    "operator": ""
>  }
>}'

Response

1{
2  "status": "enabled",
3  "generated_passwords": {
4    "propertyName*": "string"
5  }
6}

Determine Secure Mode State

When Secure Mode is enabled on the sensor, the web interface displays a Log in button on the top right.

The current state of Secure Mode on the sensor can also be queried through the HTTP API.

HTTP API

Command

$curl https://os-992623000385.ouster.internal/api/v1/auth/secure-mode/status

Response

1{
2  "enabled": true,
3  "provisioned": true,
4  "https_provisioned": true,
5  "reset_policy": "relaxed",
6  "http_redirect": true,
7  "roles_set": [
8    "admin"
9  ]
10}

Rotate Passwords

The admin role can rotate the passwords of the operator and admin roles.

Web Interface

  1. Open the sensor web interface.
  2. Go to Configuration > System.
  3. In Security (Secure Mode) under Rotate password, choose a Role and click on button Rotate password.

HTTP API

Command

$curl https://os-992623000385.ouster.internal/api/v1/auth/passwords/admin \
>  --request PUT \
>  --header 'Content-Type: application/json' \
>  --data '{
>  "password": "",
>  "generate": true
>}'

Response

1{
2  "role": "admin",
3  "password": "string"
4}

Disable Secure Mode

Note: If Reset Policy is set to relaxed, Secure Mode can be disabled by calling the HTTP API endpoint without authentication. To prevent this behavior, set the Reset Policy to strict.

Secure Mode can be disabled through the sensor’s web interface and HTTP API. Disabling Secure Mode requires authenticating with the admin role.

Web Interface

  1. Open the sensor web interface and authenticate as admin.
  2. Go to Configuration > System.
  3. In Security (Secure Mode), click on button Disable Secure Mode.

HTTP API

Command

$curl https://os-992623000385.ouster.internal/api/v1/auth/secure-mode/disable \
>  --request POST

Response

1{
2  "status": "disabled"
3}