Restrict console sign-in with access rules

Access rules limit where and when people can sign in to the console. You can allow sign-in only from listed networks, such as your office or VPN, only during set hours, or both. Rules set for the organization apply to everyone, and you can add narrower rules for one person.

How the rules work

• Rules are checked when someone signs in, after their password has been verified, and again on every request they make. A session that started inside the allowed hours stops working when the hours end.
• Signing out is always allowed.
• A person refused by a rule sees Your organization does not allow sign-in from here right now. Contact your administrator. The message does not say which rule refused them.
• A person’s own rules are added to the organization’s, not swapped for them. A sign-in has to satisfy both, so a personal rule can narrow access but never widen it.

Before you begin

• Changing the organization’s rules needs client:manage, which among the built-in roles only the owner holds. Viewing them needs client:read.
• Changing one person’s rules needs user:manage.
• Know the public address or addresses your team signs in from. The console shows the address it sees for you.

Danger

Rules that do not include the network you are on, or the current time, lock you out as soon as you save them. Keep another owner’s account, on another network, able to sign in while you test new rules.

Set rules for the organization

1. Go to Settings > Access rules.
2. On the Networks card, choose Allow sign-in from anywhere or Only from these networks.
3. If you chose Only from these networks, enter one address or CIDR block per row, for IPv4 or IPv6, such as 203.0.113.0/24 or 198.51.100.7. Select Add a network for more rows. A bare address means that address only. Anything not listed is refused, even with a correct password.
4. On the Hours card, choose Allow sign-in at any time or Only during these hours.
5. If you chose Only during these hours, choose the Timezone the hours are read in.
6. For each day, select Add hours and enter a start and end time. A day with no hours shows Closed all day.
7. Select Save sign-in rules.

The start time is inside the window and the end time is outside it, so 09:00 to 17:00 lets someone in at nine and refuses them at five. For an overnight shift, add hours on both days.

If the rules you are saving would refuse the address you are signing in from, the console warns: These rules do not include your address , which is where you are signing in from. Saving them will lock you out until another owner changes them. Select Cancel to fix the rules, or Save anyway if you mean it.

Set rules for one person

1. Go to Settings > Team.
2. On the person’s row, select Sign-in rules.
3. In Sign-in rules for the person’s name, choose Use the organization rules or Set rules for this person.
4. If you chose Set rules for this person, set Networks and Hours the same way as for the organization. Hours are read in the organization’s timezone.
5. Select Save sign-in rules.

You can set rules for your own account. The same lockout warning applies.

Verify

The page shows Saved. Ask a colleague to sign in from a network that is not listed, or outside the allowed hours. They see Your organization does not allow sign-in from here right now. Contact your administrator.

Next steps

• Invite your team
• Manage your console account