> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stoutdata.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and access

> See what installing Stout turns on, read the security state of a box, and control who can use it.

When you install Stout on a box, Stout secures the box in two layers. The **access guard** controls who can use the box. The **SSH lockdown** controls who can log in to the box over SSH.

Both layers turn on by themselves after the install. Nobody in the organization can turn them off from the dashboard. To remove both layers, [uninstall Stout](#uninstall-stout).

## The access guard

The `stout` container takes over the Lager ports on the box. It lets a request through only when a signed-in Stout user with access to the box sends it.

Owners and admins have access to every box in the organization. A member has access only to the boxes that an owner or admin assigned to them.

The first time a person runs a Lager CLI command against a secured box, Lager asks them to sign in with `lager login`. They sign in with the email and password of their Stout account. See [Signing In](https://docs.lagerdata.com/source/reference/cli/login) in the Lager docs.

## The SSH lockdown

The SSH lockdown makes these changes on the box:

* It turns off password logins and root logins.
* It lets only the box account log in over SSH.
* It removes every SSH key that Stout did not install.

After the lockdown, people log in as the box account with their own SSH key. Stout copies the keys of everyone with access to the box. See [Give people access to a box](#give-people-access-to-a-box).

Before Stout keeps the lockdown, it checks that it can still connect to the box. If that check fails, the box undoes the lockdown by itself within three minutes.

## Security states

A box is secure when only people with access can use it, and only the keys that Stout manages can log in. The health badge on the box page shows **Online** only when the box is secure. See [Health badge](/source/boxes/overview#health-badge).

The **Access** tab shows a **Security** card when the box is not secure. The card shows one of these states:

| State               | Meaning                                    |
| ------------------- | ------------------------------------------ |
| **Securing…**       | Stout still sets up one of the two layers. |
| **Needs attention** | A layer cannot turn on.                    |

The card also has two lines: **Who can use this box** and **Who can log in over SSH**. Each line shows the state of its layer and the fix for a blocked layer.

On the **Boxes** page, an amber shield in the **Health** column means that a box needs attention.

These are the usual fixes:

* If the box has no IP address, add one with **Edit** in the menu of the box.
* If Stout is not healthy on the box, install Stout again.
* If the box account has no passwordless `sudo`, fix `sudo` for that account. The lockdown then continues by itself.

Stout retries a failed layer by itself, but it waits 2 hours after a failure. If you fixed the problem, select **Retry** in the **Security** card to try at once.

<Warning>
  Before you retry the SSH lockdown, make sure that each person who needs SSH has an SSH key in Stout. The lockdown removes every key that Stout did not install.
</Warning>

When you retry the SSH lockdown, Stout asks you to confirm with **Lock down SSH**.

## Give people access to a box

A member can use a box only after an owner or admin assigns the box to them. Owners and admins always have access. Box groups do not give access.

One assignment covers every way into the box: the dashboard, the Lager CLI, and SSH.

Only owners and admins can assign boxes. To give people access:

1. Open the box, and then select the **Access** tab.
2. In **Box Access**, select **Grant Access**.
3. Find each person with the search field.
4. Select the check box of each person.
5. Select **Grant access**.

You can also select **View Access** in the menu of a box. It opens the same list. To assign boxes from the member list, use **Manage access…** in **Settings** > **Team Permissions**. See [Members and invitations](/source/organizations/members-and-invitations).

The list shows each person with access. A **Direct** badge means an assignment. A badge with a role name means that the role gives access.

Owners and admins keep their access, so only a direct assignment has an **X** to revoke it. To revoke an assignment, point at the row, select the **X**, and then select **Revoke**.

A **No SSH key** badge means that the person has no SSH key in Stout. That person can use the dashboard and the Lager CLI, but cannot log in over SSH. To add a key, see [Account](/source/organizations/account).

When you grant or revoke access, Stout updates the SSH keys on the box at once. The box applies the change within a minute. When you grant access, Stout also sends a notification to the person.

If nobody has an assignment, the tab says that only org admins can use the box.

### Access attempts

Select **View access attempts** to see the recent attempts that the box turned away. The list shows up to 20 attempts. For a person who is a member of the organization, select **Grant** to give them access.

## Uninstall Stout

Uninstalling Stout returns the box to an ordinary Lager setup. Only owners and admins can uninstall Stout.

<Warning>
  Before you uninstall Stout, tell the people who use the box. After the uninstall, anyone who can reach the box on the network can use Lager on it again.
</Warning>

1. Open the box, and then select the **Settings** tab.
2. In **Stout Daemon**, select **Uninstall Stout**.
3. Select **Uninstall**.

The **Uninstall Stout** button appears only when the Stout container on the box is healthy.

The uninstall makes these changes on the box:

* It turns off the access guard, so Lager uses its own ports again.
* It removes the SSH lockdown, if the box has one.
* It stops and removes the `stout` container, and it deletes the connection settings.
* It puts back the secrets file that the box had before Stout. If there was no such file, it deletes the Stout secrets file.
* It removes the SSH keys of the people with access. It keeps the Stout SSH key, so you can install Stout again later.

After the uninstall, the box stops reporting to Stout.

<CardGroup cols={2}>
  <Card title="Add a box" href="/source/boxes/add-a-box">
    Install Stout on a box.
  </Card>

  <Card title="Locks" href="/source/boxes/locks">
    Keep other people off a box while you work on it.
  </Card>
</CardGroup>