Ubiquiti

This guide covers Ubiquiti airMAX radios running airOS, EdgeRouters running EdgeOS, EdgeSwitch models, airFiber radios, and UniFi access points.

airOS

airOS runs on airMAX CPE and station radios such as the NanoStation, PowerBeam, LiteBeam, and Rocket series.

Prepare the account. airOS supports a single administrator account, plus an optional read-only account you can enable on the System tab. The read-only account is intended for the web UI and is not reliable for SSH retrieval, so use the administrator credentials in QUARK. QUARK only reads the configuration file and never changes the radio.

Enable SSH access. On the Services tab, enable SSH Server (port 22 by default). airOS has no built-in management ACL, so restrict TCP port 22 to the Netwatch collector's IP with an upstream ACL or firewall.

Notes. The airOS configuration is a flat text file, so version history diffs cleanly between runs.

EdgeOS

EdgeOS runs on EdgeRouter and EdgePoint models.

Create a backup account. Create a dedicated user:

configure
set system login user netwatch-backup authentication plaintext-password 'strong-password'
set system login user netwatch-backup level admin
commit
save
exit

EdgeOS also offers an operator level that can run show commands, but administrator level guarantees the displayed configuration is complete (including stored credential hashes), so we recommend level admin. The password is stored hashed after commit.

Enable SSH access. SSH is enabled by default. To confirm the service and port:

configure
set service ssh port 22
commit
save
exit

To restrict sources, add a firewall rule on the management interface that permits TCP port 22 only from the Netwatch collector's IP.

Notes. There is no separate enable password on EdgeOS — the account level alone determines rights.

EdgeSwitch

This applies to the EdgeSwitch line (for example ES-24 and ES-48 models), which uses an industry-standard style switch CLI.

Create a backup account. Create a dedicated user through the web UI's user management or from the CLI. Displaying the running configuration requires privileged (enable) mode on this platform — either create the account at the highest privilege level, or keep it at a lower level and record the enable password in QUARK so it can elevate after login.

Enable SSH access. Enable the SSH server in the switch's management access settings (Telnet, SSH, and web access are controlled there). Disable Telnet once SSH is confirmed. Use a management ACL, where your firmware supports one, to limit access to the Netwatch collector's IP.

Notes. Some firmware ships with Telnet enabled by default — audit and disable it after switching to SSH.

airFiber

This applies to airFiber point-to-point radios, whose management interface is similar to airOS.

Prepare the account. airFiber uses a single administrator account managed in the web UI; there is no separate read-only role usable for SSH. Set a strong administrator password and store those credentials in QUARK.

Enable SSH access. Enable the SSH server on the Services tab of the web UI. Restrict TCP port 22 to the Netwatch collector's IP with an upstream ACL — the radio itself offers no management ACL.

Notes. Back up both radios in a link; each end holds its own configuration.

UniFi AP

UniFi access points are managed by the UniFi Network application, which provisions their local credentials centrally.

Prepare the account. In UniFi Network, set the device SSH credentials under Settings > System > Device SSH Authentication (the exact location varies slightly between versions). All adopted devices share these credentials; enter them in QUARK.

Enable SSH access. Enabling Device SSH Authentication also enables SSH on the devices. QUARK connects directly to each access point's IP address over SSH, so make sure the collector can reach the APs' management addresses, and restrict SSH with network ACLs — the APs have no built-in source filtering.

Notes. AP configuration is provisioned from the controller, so device-level backups are best paired with regular backups of the UniFi Network application itself for a complete restore path.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.