...

...

User Administration in NetMRI

You define user administration functions in the Settings window (Settings icon –> User Admin section), performing the following tasks:

...

Several advanced User Administration settings are located in the Advanced Settings section. For more information, see Advanced User Administration Settings.

User administration provides support from external authentication servers. Because NetMRI supports both external authentication and authorization features through remote groups, mirroring the Roles and Privileges provided in local NetMRI user provisioning, you can leverage remote AAA server configurations (from TACACS+, LDAP, Active Directory, and RADIUS) without having to directly provision significant numbers of users on NetMRI.

...

...

Advantages of Remote Authentication and Authorization for Users

When a new user is authenticated and authorized through one of the remote services described in NetMRI User Authentication and Authorization, NetMRI automatically creates the new account locally and learns the Roles and device group assignments from the remote service. If there happens to be an established local user account, and the account login is authenticated and authorized by an external service, NetMRI will update its local profile to reflect the Roles and device group assignments granted by the last external authorization.

...

For more information on remote authentication and authorization of NetMRI users, see NetMRI User Authentication and Authorization and its subsections.

...

Managing User Data

For the Users and Roles pages, the Select check box is to the left of an Action icon. When you select multiple rows of a table, a whole page, or multiple pages of either data type, you can choose Delete from the Action menu for any selected row. You cannot edit multiple rows of data. The Delete option is the only available option after selecting multiple rows.

...

• You can change the local user password.
• You can disable a user account at any time.
• You can change assigned Roles and device groups for an account, but changes will persist only when the account is locally authenticated and authorized, with the Local authentication service taking the highest Priority setting and the Force Local Authentication check box enabled for the account.
• You can define CLI and database credentials, notes, and email settings.

...

Understanding Users and Roles

...

...

NetMRI provides a set of pre-defined Roles with specific privileges in NetMRI, as follows:

You can create custom Roles, with custom sets of privileges to suit the needs of your organization. You can add and remove privileges and user accounts from each of the pre-defined Roles in the NetMRI appliance. See Defining and Editing Roles for more information.

The 17 default Roles built into the system cannot be deleted from the appliance. Custom Roles can be deleted and edited.

...

Creating User Accounts

...

...

You create, edit, and delete user accounts on the Users page (Settings icon –> User Admin section–> Users). By default, the admin account is the single user account built into the appliance. You cannot remove this account.

...

1. Click Add User below the table.
2. If you want the new account to be disabled by default, check the Account Disabled check box.
3. If you want the user to be authenticated and authorized by the NetMRI appliance for their roles and device group assignments, check the Force Local Authorization check box. This enables the user to have a locally defined login that is separate from the remote one on the AAA server. Leaving this check box clear enables the user account to be subjected to authorization through a remote AAA server.

4. On the User Details tab, enter values for the First Name, Last Name, Username, and Password fields. Fill in optional fields as needed.
   

   Note

   title	Note

   User

    User account names are case-sensitive. You can use some non-alphanumeric characters for naming including bracket characters, such as @!#$%^&*()[]{}. Punctuation characters (,.;'"), the equal sign =, vertical bar |, and spacebar characters are disallowed.

   Note

   title	Note

    
   If you use TACACS+ authentication and authorization with NetMRI, keep in mind that TACACS user names are case-insensitive. Therefore, the case must not be the only difference between NetMRI and TACACS user names.

5. Click Save. The Roles, CLI Credentials, and Database Credentials tabs become available.
6. Click the Roles tab, and then click Add.
7. In the Add Role to User dialog, choose a role from the drop-down list.
8. Under In device groups, click to choose the device group(s) the user is allowed to access.
9. Click OK. The new role settings are saved for the user account.
10. On the CLI Credentials tab, define the command-line credentials as described in the procedure below.
11. On the Database Credentials tab, define the database credentials as described in the procedure below.
12. In the Add New User dialog, click Close.

...

1. In the Add New User or Edit User dialog, click the Database Credentials tab. This tab allows giving access to the NetMRI database to a user.
2. Select the Database Credentials Enabled check box. 

3. Enter the user's Username and Password values, and confirm the password. NetMRI uses these credentials for a new SQL user to access the database.

4. Click Save.
   
   

Note
title Note
The SQL username should be from 8 to 16 characters long. It should not contain special symbols.

...

To edit an existing user account, complete the following:

...

1. Click the Delete icon for the account.
2. Confirm the deletion.

...

...

Defining and Editing Roles

...

...

Note
title Note
Roles are also limited by a chosen user's permitted access to device groups. Device groups accessible to a user are specified in the user's account.

...

1. In the Edit Role –> Privileges tab, click Add.
2. In the Add Privileges dialog, select the Privileges check boxes (see list below) to be associated with the role.
3. Click OK.
4. In the Edit Role dialog, click Save & Close.

...

Editing Roles

...

To edit a role, perform the following:

...

1. Click Delete for the role.
2. Confirm the deletion.

...

1. deletion.

Privilege Descriptions

The following NetMRI system privileges can be assigned to Roles:

...

...

...

Viewing the User Audit Log

...

The Audit Log (Settings icon –> User Admin –> Audit Log) lists all actions taken by user accounts that result in changes to NetMRI or any of the data sets the account manages. Log entries include the timestamp in which the action was taken, the User name, a description of the action, and field change details when applicable.

Log entries are initially ordered by time, with the most recent at the top of the list. The table can be reordered, for example, to consolidate a particular user's actions. Alternatively, use quick searching to isolate specific log entries.

...

...

Managing User Audit Logs for SSH Connection Attempts to Devices

As an aid to track what NetMRI or its users are doing on the network, you can also view the audit logs for all events in which NetMRI or its users attempt to use SSH or Telnet sessions to network devices. The amount of data collected for such events can substantially impact the size of the collected event database, so you can switch this feature on and off when needed and change the duration of these events being held in the database. Connection events that are covered by this log category include SSH/Telnet connections for Config Collection, Credential Collection, terminal emulation, and Job Engine Run connections. Unknown connections may also be recorded, which will be events such as API calls.

To view and change these settings, go to Settings icon –> General Settings –> Advanced Settings –> Notification category –> Log All CLI Sessions. The default value is On. You can also choose the No Commands Logged option, which retains the session events but prevents any sensitive CLI data from being recorded.

An associated Advanced Setting, Prune CLI Session Duration, enables you to regularly prune the amount of CLI session data by setting the retention time for keeping that data in the Device Audit Log. The default setting is 7 days.

...

Avanced User Administration Settings

Several important global NetMRI user account settings are located in the Advanced Settings section. To access them, go to Settings icon –> General Settings –> Advanced Settings, and then use the Next Page button to get to the User Administration category. Advanced User Administration settings determine the following:

...