Managing Access Control in PresSTORE

Transcription

1 Managing Access Control in PresSTORE This article describes the functions to limit access for users in PresSTORE and discusses some scenarios as examples how to to configure non-administrator restore functions. The PresSTORE Process Access Permissions During installation, the PresSTORE job is set up to run with the highest privileges possible. The PresSTORE process (nsd on Unix systems, nsd.exe on Windows) runs with the root account on Unix and with system account on Windows. This is necessary to read all files during sync and backup, please do not attempt to use this for own user limitations. Login Access to PresSTORE Before working with PresSTORE via web GUI, a user has to authenticate by typing user name and password. This pair is then checked using operating system functions. PresSTORE does not maintain account information itself, instead it checks whether the user is permitted to login on the host where PresSTORE is running. On Unix like hosts (Mac, Linux, Solaris), the so called Pluggable Authentication Module is used for the check, so the authentication method used by the server can be influenced via PAM administration. The Omnipotent Administrator Account The administrator accounts in PresSTORE are omnipotent, each administrator has unlimited access to PresSTORE's web GUI. Administrators are users that belong to the following operating system level user groups: psadm (this groups does usually not exist) SysAdm (this group is added for helios support) admin (to support the admin group on Macs) the group 544 on Windows hosts, the administrator group Managing Access Control in PresSTORE 1/6

2 The following sketch shows the groups that enjoy administrator privileges in PresSTORE: The groups are identified by their name except for the group 544 on Windows which is identified by its group id because the name changes with the localization. In addition to these group memberships, the special user root (identified by name or, on Unix hosts, by the UID 0) is also administrator in PresSTORE. The Operator Account PresSTORE supports one more special account type: the Operator. This type of account is intended for non-administrator users who are allowed to maintain jobs and media. Operators in PresSTORE are users who a members of the operating system level user group psops or PrnAdm. The group psops usually does not exist, the group PrnAdm exists on Helios servers. Managing Access Control in PresSTORE 2/6

3 Operators are permitted to start and stop jobs in PresSTORE run jukebox inventories move media to or from the mail slot in a jukebox label tapes All other permissions of operators are the same as for normal users. Access Control Functions in PresSTORE Access control for users is maintained based on so called login areas. After login, the user will see only those login areas he/she may access. By permitting access to a login area, users are at the same time permitted to use the functions within a login area. Permissions for login areas are maintained on user group level. Please note that there is one special group named root that stands for all administrators, even if that root group does not exist on the operation system, e.g. as on Windows. Furthermore, user preferences allow to set up restrictions on a user base, these restrictions are applied to the user logged in. The following PresSTORE resources handle access permissions: Login areas may be restricted to users belonging to configured operating system level groups. This means that the login area remains invisible for other users. User preferences may restrict access permissions for each user. E.g. specific users may have access only to one login area (usually their own backup), while others have no such restriction. Default user preferences can be preset by adopting the generic user preferences template. Furthermore, the place to restore data to as well as the access to the PresSTORE functions (backup, archive,...) can be restricted per user. Clients may restrict the place to restore data to by predefining a special path to restore to. For details how to edit and where to find the single entries, please refer to the PresSTORE online manual. Managing Access Control in PresSTORE 3/6

4 The following sketch gives an overview of the permission management in PresSTORE Managing Access Control in PresSTORE 4/6

5 Example: Allow restore operations of user's own data This example shows a typical network with multiple workstation users. Each user shall be permitted to restore his data from backup, but users shall not get access to other users data and the restore shall write to a predefined folder only. Access to other backups or archives shall be denied. This setup can be achieved with the following steps: Create a Login Area for each user. Select the according backup index and set path to the path of the user's backup. In the User Preferences for the according user, remove download and archive from the list of Allowed operations and set the Login behavior to the above login area. In the Additional Options of the User Preferences, set the Fixed restore path to the desired folder on the user's client. Managing Access Control in PresSTORE 5/6

6 Example: Allow Archive and Restore Operations on Servers This example assumes an archive solution of two servers. Each user shall be permitted to archive data with one archive index, and all users may restore data to a specific folder on each server. This setup can be achieved with the following steps: Restrict access to all login areas. Administrators may adopt PresSTORE's method to restrict the access of the login areas General Setup and Job and Storage Management to members of group root by setting Allow access for group(s) in all login areas to group root. Grant access to the required Archive Plan by adding a user group to the according login area. If no group for these users exists, it is possible to create a new group, e.g. archivists in the operating system and declare users as members of that group. In the Client setup for the two servers, navigate to the Additional Options and set the Paths to restore to the desired folder. In case multiple paths are entered, users may select one of these before restore. Managing Access Control in PresSTORE 6/6