Assigning privileges to usergroups for the SSB web interface
This section describes how to assign privileges to a new group.
To assign privileges to a new group
-
Navigate to AAA > Access Control and click 
.
-
Find your usergroup. If you start typing the name of the group you are looking for, the autocomplete function will make finding your group easier for you.
-
Click 
located next to the name of the group. The list of available privileges is displayed.
-
Select the privileges (pages of the syslog-ng Store Box (SSB) interface) to which the group will have access and click Save.
NOTE: To export the configuration of SSB, the Export configuration privilege is required.
To import a configuration to SSB, the Import configuration privilege is required.
To update the firmware and set the active firmware, the Basic settings > System privilege is required.
-
Select the type of access (read or read & write) from the Type field.
-
Click 
.
Modifying group privileges
This section describes how to modify the privileges of an existing group.
To modify the privileges of an existing group
-
Navigate to AAA > Access Control.
-
Find the group you want to modify and click . The list of available privileges is displayed.
-
Select the privileges (pages of the syslog-ng Store Box (SSB) interface) to which the group will have access and click Save.
Figure 77: AAA > Access Control — Modifying group privileges
|
|
Caution:
Assigning the Search privilege to a user on the AAA page grants the user search access to every logspace, even if the user is not a member of the groups listed in the Access Control option of the particular logspace. |
-
Select the type of access (read or read & write) from the Type field.
-
Click .
Finding specific usergroups
The Filter ACLs section of the AAA > Access Control page provides you with a simple searching and filtering interface to search the names and privileges of usergroups.
Figure 78: AAA > Access Control — Finding specific usergroups
-
To select usergroups starting with a specific string, enter the beginning of the name of the group into the Group field and select Search.
-
To select usergroups who have a specific privilege, click , select the privilege or privileges you are looking for, and click Search.
-
To filter for read or write access, use the Type option.
How to use usergroups
How you should name usergroups depends on the way you manage your syslog-ng Store Box (SSB) users.
-
Local users: If you use only local users, create or modify usergroups on the AAA > Group Management page, assign or modify privileges on the AAA > Access Control page, and add users to the groups on the AAA > Local Users or the AAA > Group Management page.
-
LDAP users and LDAP groups: If you manage your users from LDAP, and also have LDAP groups that match the way you want to group your SSB users, create or modify your usergroups on the AAA > Access Control page and ensure that the name of your LDAP group and the SSB usergroup is the same. For example, to make members of the admins LDAP group be able to use SSB, create a usergroup called admins on the AAA > Access Control page and edit the privileges of the group as needed.
|
|
Caution:
A user can belong to a maximum of 10,000 groups, further groups are ignored. |
-
RADIUS users and local groups: This is the case when you manage users from RADIUS, but you cannot or do not want to create groups in LDAP. Create your local groups on the AAA > Access Control page, and add your RADIUS users to these groups on the AAA > Group Management page.
-
OpenID Connect users and local groups: This is the case when you manage users from OpenID Connect, but you cannot or do not want to create groups in LDAP. Create your local groups on the AAA > Access Control page, and add your OpenID Connect users to these groups on the AAA > Group Management page.
