---
title: 'Tutorial: Manage the Local Authentication Method from the Command-Line Interface'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--local-auth-command-line/
product: Access Server Docs
description: Use this tutorial to manage local authentication for Access Server from the command-line interface.
---

# Tutorial: Manage the Local Authentication Method from the Command-Line Interface

## Overview

Use this tutorial to find the commands necessary to manage the local authentication method for Access Server.

Access Server stores user and group properties in the **/usr/local/openvpn\_as/etc/db/userprop.db** file for local authentication mode.

Access Server supports [hashed passwords](https://openvpn.net/as-docs/v3/tutorials/tutorial--local-password-hashing.md) in the user properties database in SHA256, PBKDF2, or SCrypt format. New password hashes are stored as PBKDF2 by default. PBKDF2 is implemented with a 16-byte random salt, SHA-256 hashing, a 32-byte output length, and 100,000 iterations.

## Prerequisites

- An installed Access Server.
- Console access with the ability to get root privileges.

## Commands to configure local authentication

- Set the default authentication mode to local:

  ```
  sacli --key "auth.module.type" --value "local" ConfigPut
  sacli start
  ```
- Prefer the SCrypt password hashing method (on Access Server 2.11 and newer):

  ```
  sacli --key "auth.local.0.prefer_scrypt" --value "true" ConfigPut
  sacli start
  ```
- Add a new user from scratch:

  ```
  sacli --user <USER_NAME> --key "type" --value "user_connect" UserPropPut
  sacli start
  ```
- Set password for a user in local authentication mode:

  ```
  sacli --user '<USER_NAME>' --new_pass '<PASSWORD>' SetLocalPassword
  sacli start
  ```
- Set the authentication mode for the user (on Access Server 2.10 and newer):

  ```
  sacli --user <USER> --key "user_auth_type" --value "local" UserPropPut
  sacli start
  ```
- Remove password for a user in local authentication mode:

  ```
  sacli --user <USER_NAME> RemoveLocalPassword
  sacli start
  ```
- Remove all user properties to delete the user:

  ```
  sacli --user <USER_OR_GROUP> UserPropDelAll
  sacli start
  ```

---

Prev: [Tutorial: Allow Users to Change Passwords from the Client Web UI](https://openvpn.net/as-docs/v3/tutorials/tutorial--user-password-change-cws.md)
Next: [RADIUS Authentication](https://openvpn.net/as-docs/v3/tutorials/radius-authentication.md)
Index: https://openvpn.net/as-docs/llms.txt