Users

Introduction

This section describes users who may administer the appliance, roles to manage authorizations granted to users, and how to add them to the system using the BUI or CLI.

Users can either be:

• Local users - all their account information is saved on the appliance.

• Directory users - this uses existing NIS or LDAP accounts, and saves supplemental authorization settings on the appliance. This allows existing NIS or LDAP users to be granted privileges to login and administer the appliance.

Users are granted privileges by assigning them custom roles.

Roles

A role is a collection of privileges that can be assigned to users. It may be desirable to create administrator and operator roles, with different authorization levels. Staff members may be assigned any role that is suitable for their needs, without assigning unnecessary privileges.

The use of roles is considered to be much more secure than the use of shared administrator passwords, for example, giving everyone the root password. Roles restrict users to necessary authorizations only, and also attribute their actions to their individual username in the Audit log.

By default, a role called "Basic administration" exists, which contains very basic authorizations.

Authorizations

Authorizations allow users to perform specific tasks, such as creating shares, rebooting the appliance, and updating the system software. Authorizations are grouped into Scopes, and each scope may have a set of optional filters to narrow the scope of the authorization. For example, rather than an authorization to restart all services, a filter can be used so that this authorization can restart the HTTP service only.

Available scopes are as follows, with a single example authorization and an example filter (if available) for each scope:

Browse the scopes in the BUI to see what other authorizations exist. There are currently over fifty different authorizations available, and additional authorizations may be added in future appliance software updates.

Properties

The following properties may be set when managing users and roles.

Users

All of the following properties may be set when adding a user, and a subset of these when editing a user:

Roles

These properties may be set when managing roles:

BUI

The BUI Users page lists both users and groups, along with buttons for administration. Mouse-over an entry to expose its clone, edit and destroy buttons. Double-click an entry to view its edit screen. The buttons are as follows:

icon description Add new user/role. This will display a new dialog where the required properties may be entered. Displays a search box. Enter a search string and hit enter to search the user/role lists for that text, and only display entries that match. Click this icon again or "Show All" to return to the full listings. Clone user/role. Add a new user/role starting with fields based on the values from this entry Edit user/role Remove user/role/authorization

Refer to the Tasks for required steps to add users, roles and authorizations.

CLI

The actions possible in the BUI are also available in the CLI. Type help as you navigate through user, role, and authorization administration to list the available commands.

To demonstrate the CLI user and roles interface, the following example adds the NIS user "brendan" to the system, and grants the authorization to restart the HTTP service. This includes creating a role for this authorization.

We will start by creating the role, which we will call "webadmin":

caji:> configuration roles
caji:configuration roles> role webadmin
caji:configuration roles webadmin (uncommitted)> set
   description="web server administrator" 
                   description = web server administrator (uncommitted)
caji:configuration roles webadmin (uncommitted)> commit
caji:configuration roles> show
Roles:

NAME             DESCRIPTION
basic            Basic administration
webadmin         web server administrator

Now that we have created the webadmin role, we will add the authorization to restart the HTTP service; This example also shows the output of tab-completion, which lists valid input and is useful when determining what are valid scopes and filter options:

caji:configuration roles> select webadmin
caji:configuration roles webadmin> authorizations
caji:configuration roles webadmin authorizations> create
caji:configuration roles webadmin auth (uncommitted)> set scope=tab 
ad           cluster      net          schema       update       
alert        hardware     replication  stat         user         
appliance    nas          role         svc          worksheet    
caji:configuration roles webadmin auth (uncommitted)> set scope=svc
                         scope = svc
caji:configuration roles webadmin auth (uncommitted)> show
Properties:
                         scope = svc
                       service = *
              allow_administer = false
               allow_configure = false
                 allow_restart = false

caji:configuration roles webadmin auth (uncommitted)> set service=tab 
*               ftp             ipmp            nis             ssh
ad              http            iscsi           ntp             tags
smb            identity        ldap            routing         vscan
datalink:nge0   idmap           ndmp            scrk            
dns             interface:nge0  nfs             snmp            
caji:configuration roles webadmin auth (uncommitted)> set service=http
                       service = http (uncommitted)
caji:configuration roles webadmin auth (uncommitted)> set allow_restart=true
                 allow_restart = true (uncommitted)
caji:configuration roles webadmin auth (uncommitted)> commit
caji:configuration roles webadmin authorizations> list
NAME       OBJECT                               PERMISSIONS
auth-000   svc.http                             restart

Now that the role has been created, we can enter the users section to create our user "brendan" and assign the role "webadmin":

caji:configuration roles webadmin authorizations> cd ../../..
caji:configuration> users
caji:configuration users> netuser brendan
caji:configuration users> show
Users:

NAME                     USERNAME                 UID        TYPE
Brendan Gregg            brendan                  130948     Dir
Super-User               root                     0          Loc

caji:configuration users> select brendan
caji:configuration users brendan> show
Properties:
                       logname = brendan
                      fullname = Brendan Gregg
              initial_password = *************
            require_annotation = false
                         roles = basic
                    kiosk_mode = false
                  kiosk_screen = status/dashboard

Children:
                       exceptions => Configure this user's exceptions
                      preferences => Configure user preferences
caji:configuration users brendan> set roles=basic,webadmin
                         roles = basic,webadmin (uncommitted)
caji:configuration users brendan> commit

The user brendan should now be able to login using their NIS password, and restart the HTTP service on the appliance.

Tasks

The following are example tasks for user and role administration. If you wish to use the CLI, it can help to practice these tasks in the BUI first - which is more intuitive and will help convey concepts.

BUI

Adding an administrator

1. Check that an appropriate administrator role is listed in the Roles list. If not, add a role (see separate task).
2. Click the add icon next to Users.
3. Set user properties.
4. Click the checkbox for the administrator role.
5. Click the Add button at the top of the dialog. The new user appears in the Users list.

Adding a role

1. Click the add icon next to Roles.
2. Set the name of the role, and description.
3. Add authorizations to the role (see separate task).
4. Click the Add button at the top of the dialog. The new role appears in the Roles list.

Adding authorizations to a role

1. Select "Scope". If filters are available for this scope, they will appear beneath the Scope selector.
2. Select filters if appropriate.
3. Click the checkbox for all authorizations you wish to add.
4. Click the Add button in the Authorization section. The authorizations will be added to the bottom list of the dialog box.

Deleting authorizations from a role

1. Mouse-over the role in the Roles list, and click the edit icon.
2. Mouse-over the authorization in the bottom list, and click the trash icon on the right.
3. Click the Apply button at the top of the dialog.

CLI

Adding an administrator

1. Go to configuration roles.
2. Type show. Find a role with appropriate administration authorizations by running select on each role and then authorizations show. If an appropriate role does not exist, start by creating the role (see separate task).
3. Go to configuration users.
4. For Directory users (NIS, LDAP), type netuser followed by the existing username you wish to add. For Local users, type user followed by the username you wish to add; then type show to see the properties that need to be set and set them, then type commit.
5. At this point you have a created user, but haven't customized all their properties yet. Type select followed by their username.
6. Now type show to see the full list of preferences. Roles and authorization exceptions may now be added, as well as user preferences.

Adding a role

1. Go to configuration roles.
2. Type role followed by the role name you wish to create.
3. Set the description, then commit the role.
4. Add authorizations to the role (see separate task).

Adding authorizations to a role

1. Go to configuration roles.
2. Type select followed by the role name.
3. Type authorizations.
4. Type create to add an authorization
5. Type set scope= followed by the scope name. Use tab-completion to see the list.
6. Type show to see both available filters and authorizations.
7. set the desired authorizations to true, and set the filters (if available). Tab-completion helps show which filter settings are valid.
8. Type commit. The authorization has now been added.

Deleting authorizations from a role

1. Go to configuration roles.
2. Type select followed by the role name.
3. Type authorizations.
4. Type show to list authorizations.
5. Type destroy followed by the authorization name (eg, "auth-001"). The authorization has now been destroyed.

Generic

Adding a user who can only view the dashboard

1. Add either a Directory or Local user (see separate task).
2. Set Kiosk mode to true, and check that the Kiosk screen is set to "status/dashboard".
3. The user should now be able to login, but only view the dashboard.