Station Compliance›Equipment›Tieline

What that does not cover

A unique password at the factory describes how a unit left the factory. It does not describe the unit in your rack, and that is the question 47 CFR § 11.35(d) asks. Three things are still yours to confirm:

• Whether your units predate v3.12.xx. Older units, and any unit commissioned before that release, may still carry a shared or default credential.
• Whether the password was changed at commissioning. Tieline's own guidance is to change the Toolbox HTML5 Web-GUI default password immediately when you commission a codec. A unit set up years ago by someone else may not have been.
• That it sits behind your firewall. A strong password does not make an internet-facing management interface acceptable, and the rule has a separate segmentation requirement that the password does nothing for.

About the default password

This page does not print a factory credential for Tieline codecs. On a current unit there is no single default to print, because each codec ships with its own. On an older unit, take it from the manual for that unit rather than from a remembered list.

On a current unit the question is not "is it still on the default" so much as "is that unique password recorded somewhere the station controls, and does anyone here still know where".

Do this today

1. Find the firmware version on every Tieline unit, studio end and field end. Record the version and the date you checked.
2. For any unit older than v3.12.xx, set a strong password of 15 characters or more on every account that can change its configuration.
3. Look at the accounts and access levels, including Cloud Codec Controller. Remove access that belongs to nobody who still works with you.
4. Confirm the codec's management interface is not reachable from the public internet. Check your router for port-forwarding rules and DMZ assignments pointing at it. Then check from outside, from a phone on cellular data, not station Wi-Fi.

If you update the firmware

Firmware updates are applied from a single-partition FAT32-formatted SD card in the front panel slot. Disconnect all connections before upgrading, and plan it for a time the codec is not carrying a feed you need.

Keeping the unit off the public internet is essential, but it satisfies the separate segmentation requirement, not the password one: the FCC's FAQ says a firewall or VPN in front of the device is not enough, and the device itself must use a strong password or an alternative authentication measure. Record what you checked, and when, in your own file.

Don't forget the cloud account

Tieline's Cloud Codec Controller reaches your codecs from anywhere, and the account that signs in to it does not live on any device in your building. When someone leaves, that is one of the places their access has to end. The test is the same as for any credential: if this account lets someone change what goes out over the air, it is a program chain credential and the same standard applies.

Don't stop at the web password

Most networked broadcast gear offers more than one way in: web, Telnet, SSH, SNMP, a vendor application, a serial console, sometimes a front panel. These frequently keep separate credential stores. We have not verified which management paths on Tieline codecs share a credential and which do not, so do not assume. List every management path your unit offers, starting with the manual, then verify each one separately: log in through it, confirm the new credential works, and confirm the old one does not.