The syslog-ng Store Box (SSB) appliance has the following usergroups by default. Note that you can modify and delete these usergroups as you see fit.
|
|
Caution:
If you use LDAP authentication on the SSB web interface and want to use the default usergroups, you have to create these groups in your LDAP database and assign users to them. For details on using usergroups, see How to use usergroups. |
-
basic-view: View the settings in the Basic Settings menu, including the system logs of SSB. Members of this group can also execute commands on the Troubleshooting tab.
-
basic-write: Edit the settings in the Basic Settings menu. Members of this group can manage SSB as a host.
-
auth-view: View the names and privileges of the SSB administrators, the configured usergroups, and the authentication settings in the AAA menu. Members of this group can also view the history of configuration changes.
-
auth-write: Edit authentication settings and manage users and usergroups.
|
|
Caution:
Members of the auth-write group, or any other group with write privileges to the AAA menu are essentially equivalent to system administrators of SSB, because they can give themselves any privilege. Users with limited rights should never have such privileges.
If a user with write privileges to the AAA menu gives himself new privileges (for example gives himself group membership to a new group), then he has to relogin to the SSB web interface to activate the new privilege. |
-
search: Browse and download various logs and alerts in the Search menu.
NOTE: The admin user is not a member of this group by default, so it cannot remotely access the shared logspaces.
-
changelog: View the history of SSB configuration changes in the AAA > Accounting menu.
-
report: Browse, create and manage reports, and add statistics-based chapters to the reports in the Reports menu.
NOTE: To control exactly which statistics-based chapters and reports can the user include in a report, use the Use static subchapters privileges.
-
policies-view: View the policies and settings in the Policies menu.
-
policies-write: Edit the policies and settings in the Policies menu.
|
|
Caution:
Members of this group can make the logs stored on SSB available as a shared network drive. In case of unencrypted logfiles, this may result in access to sensitive data. |
-
log-view: View the logging settings in the Log menu.
-
log-write: Configure logging settings in the Log menu.
The syslog-ng Store Box (SSB) appliance automatically tracks every change of its configuration. To display the history of changes, select AAA > Accounting. The changes are organized as log messages, and can be browsed and searched using the regular SSB search interface (for details, see Searching log messages). The following information is displayed about each modification:
Figure 79: AAA > Accounting — Browsing configuration changes
-
Timestamp: The date of the modification.
-
Author: Username of the administrator who modified the configuration of SSB.
-
Page: The menu item that was modified.
-
Field name: The name of the field or option that was modified.
-
New value: The new value of the configuration parameter.
-
Message: The changelog or commit log that the administrator submitted. This field is available only if the Require commit log option is enabled (see below).
-
Old value: The old value of the configuration parameter.
- Swap: Indicates if the order of objects was modified on the page (for example, the order of two policies in the list).
To request the administrators to write an explanation to every configuration change, navigate to AAA > Settings > Accounting settings and select the Require commit log option.
The following sections explain the basic management tasks of syslog-ng Store Box (SSB).
-
For basic management tasks (reboot and shutdown, disabling traffic), see Controlling SSB: restart, shutdown.
-
For managing a high availability cluster, see Managing a high availability SSB cluster.
-
For instructions on upgrading SSB, see Upgrading SSB.
-
For instructions on accessing SSB through console and SSH, see Accessing the SSB console.
-
For enabling sealed mode (which disables basic configuration changes from a remote host), see Sealed mode.
-
For information on configuring the out-of-band (IPMI) interface, see Out-of-band management of SSB.
-
For managing certificates used on SSB, see Managing the certificates used on SSB.
-
For creating hostlist policies, see Creating hostlist policies.
To restart or shut down syslog-ng Store Box (SSB), navigate to Basic Settings > System > System control and click the respective action button. The Other node refers to the slave node of a high availability SSB cluster. For details on high availability clusters, see Managing a high availability SSB cluster.
|
|
Caution:
-
When rebooting the nodes of a cluster, reboot the other (slave) node first to avoid unnecessary takeovers.
-
When shutting down the nodes of a cluster, shut down the other (slave) node first. When powering on the nodes, start the master node first to avoid unnecessary takeovers.
-
When both nodes are running, avoid interrupting the connection between the nodes: do not unplug the Ethernet cables, reboot the switch or router between the nodes (if any), or disable the HA interface of SSB. |
Figure 80: Basic Settings > System > System control — Performing basic management
NOTE: Web sessions to the SSB interface are persistent and remain open after rebooting SSB, so you do not have to relogin after a reboot.
