Advanced permissions/user properties

[Alex Burger]

Hi Tobias.

Tobias Klausmann wrote:
> I think one could make a case for x being everything that
> concerns the current state of an object, i.e. mainly
> acknowledgement(s). The w flag could be used for en/disabling
> (semi)permanent stuff, like disabling active checks. 
> 
> On the other hand, many actions (like schedule downtime) would
> fall into a grey area, so maybe using x for all of them and
> "keeping" w for later is better.

Right now, all commands that can be submitted are grouped together.  I 
don't think there is currently any way to to allow someone to schedule 
downtime, but not force a check of all services.  This of course could 
be changed, but I haven't looked at it yet.

To implement this, we would need a list of all the possible service / 
host commands, and what permission a user should have to execute it.  I 
had a quick look and it looks like most should require a 'wx' permission 
except for maybe 'schedule an imemdiate check of all services'.  I don't 
like the idea of giving 're-schedule the next check of this service' to 
anyone with read access as they could set it to check a week from now. 
Like you said, maybe it's better to just keep the 'x' as it is.

>> I also changed it so that you will only see a service if you are a 
>> contact for it.  I think this is the same change that Ton mentioned in 
>> his last email.  I did this to test the 'r' permission.
> 
> This was the default in our installation (by way of not having an
> asterisk in the corresponding line(s) in the main config file.

It looks like if you are a contact for a host, then you automatically 
have access to view all services.  I tested this by making a user 
(group) a contact for a host and only two of the host's services.  The 
user was able to see all services even though he was not listed on the 
others.

Alex


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null