Chat now with support
Chat with Support

syslog-ng Store Box 6.9.0 - Administration Guide

Preface Introduction The concepts of SSB The Welcome Wizard and the first login Basic settings User management and access control Managing SSB Configuring message sources Storing messages on SSB Forwarding messages from SSB Log paths: routing and processing messages Configuring syslog-ng options Searching log messages Searching the internal messages of SSB Classifying messages with pattern databases The SSB RPC API Monitoring SSB Troubleshooting SSB Security checklist for configuring SSB Glossary

Modifying group privileges

This section describes how to modify the privileges of an existing group.

To modify the privileges of an existing group

  1. Navigate to AAA > Access Control.

  2. Find the group you want to modify and click . The list of available privileges is displayed.

  3. Select the privileges (pages of the syslog-ng Store Box (SSB) interface) to which the group will have access and click Save.

    Figure 66: AAA > Access Control — Modifying group privileges

    		 Caution:

    Assigning the Search privilege to a user on the AAA page grants the user search access to every logspace, even if the user is not a member of the groups listed in the Access Control option of the particular logspace.

  4. Select the type of access (read or read & write) from the Type field.

  5. Click .

Finding specific usergroups

The Filter ACLs section of the AAA > Access Control page provides you with a simple searching and filtering interface to search the names and privileges of usergroups.

Figure 67: AAA > Access Control — Finding specific usergroups

  • To select usergroups starting with a specific string, enter the beginning of the name of the group into the Group field and select Search.

  • To select usergroups who have a specific privilege, click , select the privilege or privileges you are looking for, and click Search.

  • To filter for read or write access, use the Type option.

How to use usergroups

How you should name usergroups depends on the way you manage your syslog-ng Store Box (SSB) users.

  • Local users: If you use only local users, create or modify usergroups on the AAA > Group Management page, assign or modify privileges on the AAA > Access Control page, and add users to the groups on the AAA > Local Users or the AAA > Group Management page.

  • LDAP users and LDAP groups: If you manage your users from LDAP, and also have LDAP groups that match the way you want to group your SSB users, create or modify your usergroups on the AAA > Access Control page and ensure that the name of your LDAP group and the SSB usergroup is the same. For example, to make members of the admins LDAP group be able to use SSB, create a usergroup called admins on the AAA > Access Control page and edit the privileges of the group as needed.

    		 Caution:

    A user can belong to a maximum of 10,000 groups, further groups are ignored.

  • RADIUS users and local groups: This is the case when you manage users from RADIUS, but you cannot or do not want to create groups in LDAP. Create your local groups on the AAA > Access Control page, and add your RADIUS users to these groups on the AAA > Group Management page.

Built-in usergroups of SSB

The syslog-ng Store Box (SSB) appliance has the following usergroups by default. Note that you can modify and delete these usergroups as you see fit.

 Caution:

If you use LDAP authentication on the SSB web interface and want to use the default usergroups, you have to create these groups in your LDAP database and assign users to them. For details on using usergroups, see How to use usergroups.

  • basic-view: View the settings in the Basic Settings menu, including the system logs of SSB. Members of this group can also execute commands on the Troubleshooting tab.

  • basic-write: Edit the settings in the Basic Settings menu. Members of this group can manage SSB as a host.

  • auth-view: View the names and privileges of the SSB administrators, the configured usergroups, and the authentication settings in the AAA menu. Members of this group can also view the history of configuration changes.

  • auth-write: Edit authentication settings and manage users and usergroups.

    		 Caution:

    Members of the auth-write group, or any other group with write privileges to the AAA menu are essentially equivalent to system administrators of SSB, because they can give themselves any privilege. Users with limited rights should never have such privileges.

    If a user with write privileges to the AAA menu gives himself new privileges (for example gives himself group membership to a new group), then he has to relogin to the SSB web interface to activate the new privilege.

  • search: Browse and download various logs and alerts in the Search menu.

    NOTE: The admin user is not a member of this group by default, so it cannot remotely access the shared logspaces.

  • changelog: View the history of SSB configuration changes in the AAA > Accounting menu.

  • report: Browse, create and manage reports, and add statistics-based chapters to the reports in the Reports menu.

    NOTE: To control exactly which statistics-based chapters and reports can the user include in a report, use the Use static subchapters privileges.

  • policies-view: View the policies and settings in the Policies menu.

  • policies-write: Edit the policies and settings in the Policies menu.

    		 Caution:

    Members of this group can make the logs stored on SSB available as a shared network drive. In case of unencrypted logfiles, this may result in access to sensitive data.

  • log-view: View the logging settings in the Log menu.

  • log-write: Configure logging settings in the Log menu.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating