Accounts

Diagnostic Account

The Diagnostic Account is a built-in system account used to verify that RADIUS authentication and network connectivity are working correctly — without touching real user data. It provides a safe, isolated credential set for infrastructure testing at any time.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/diagnostic-account/overview.png

The Diagnostic Account panel showing status toggle, username, and password reset controls.

What is the Diagnostic Account?

Kiwire automatically provisions a special system account with the username diagnostic for every tenant. This account exists solely for infrastructure verification — it behaves like a normal RADIUS user but is clearly marked as a system account and is excluded from reporting, billing, and session analytics.

Because the diagnostic account is a real RADIUS account, a successful authentication test against it confirms that the full chain is working: Kiwire is reachable, the RADIUS server is processing requests, and shared secrets are configured correctly on the access point.

How to Run a RADIUS Test

Use the diagnostic account together with the RADIUS Test tool found under Monitoring › RADIUS Test:

Navigate to Monitoring › RADIUS Test.
Select the target device (NAS) from the dropdown.
Enter the diagnostic credentials — username diagnostic and the current password shown in this panel.
Click Run Test. Kiwire sends an Access-Request packet to the RADIUS server and displays the response (Access-Accept or Access-Reject) along with round-trip timing.

A successful Access-Accept response confirms that RADIUS authentication is fully operational for the selected device.

Run a diagnostic test immediately after adding a new access point or changing a RADIUS shared secret to confirm the configuration is correct before users start connecting.

Resetting the Password

Click the Reset Password button to generate a new random password for the diagnostic account. The new password is displayed immediately — copy it before navigating away, as it will not be shown again in plain text. The previous password is invalidated instantly.

Resetting the diagnostic password does not affect any real user accounts. Only the diagnostic system account is changed.

Enabling and Disabling

The status toggle allows you to enable or disable the diagnostic account at any time. When disabled, the account will receive an Access-Reject during any RADIUS test — useful for confirming that inactive accounts are correctly rejected by the RADIUS server.

Status	Behaviour
Enabled	RADIUS test returns `Access-Accept` when credentials are correct
Disabled	RADIUS test returns `Access-Reject` regardless of credentials

Security Considerations

Never share the diagnostic account credentials with end users or configure it on a real device as a production account. It is a testing tool only — it is not subject to the same session limits, quota tracking, or reporting as regular user accounts.

The diagnostic password is generated randomly and should be rotated regularly, especially in production environments.
Disable the diagnostic account when not actively running tests to reduce the attack surface.
Access to this panel is controlled by the view-diagnostic-account and update-diagnostic-account permissions — restrict them to network administrators only.

Required Permissions

view-diagnostic-account · update-diagnostic-account