...
- Create, edit, and delete user accounts. Each user account is assigned one or more Device Groups over which they have some administrative functions.
- Define two primary types of users: local user and remote user.
- Local users have their entire login credentials, user Roles, and device group permissions defined locally on the NetMRI appliance.
- Remote users have Roles assignments and device group permissions defined in Authentication Service Properties, and those assignments and permissions are granted remotely through an external service.
...
| title | Note |
|---|
- Device groups are a NetMRI organizational unit that gathers devices in related groups—routers in a Routers group, Ethernet switches in a Switches group, and so on. For related information on device groups, see Devices and Interfaces.
- Create, edit, and delete user Roles. You assign Roles to each individual user account and define the privileges and tasks, and specific networks and network devices on which the NetMRI user can operate. A user account is ineffective without an assigned Role. A user account can use one or more Roles.
- Each Role is comprised of a set of access Privileges, which are the types of tasks that the user can carry out in their assigned Role.
- Review the Audit Log. The Audit Log provides records of all actions taken by all NetMRI users, showing the timestamp, event type, and associated descriptive messages.
...
| Note | ||
|---|---|---|
| ||
Privileges play a key part in Roles configuration. Each of the pre-defined roles uses a specific collection of Privileges, which are pre-defined administrative functions that cannot be edited or changed. You can delete Privileges from a defined Role and create new Roles with custom sets of Privileges. Also, see see Privilege Descriptions for for details on the Privileges comprising user Roles. |
...
NetMRI provides a set of pre-defined Roles with specific privileges in NetMRI, as follows:
| Analysis Admin | Specializes in creating and managing NetMRI Issues. Assigned privileges include Issues: Modify Parameters, Issues: Modify Suppression Parameters, Issues: Modify Priority, Issues, Define Notifications, and View: Non Sensitive. |
| Change Engineer: High | Allowed to author, approve, execute, and schedule scripts designated High Level (Level 3) and lower. Privileges include the following:
This role can launch SSH and Telnet sessions using NetMRI's Telnet/SSH Proxy feature using User Credentials (Terminal: Open Session privilege). This role can modify CLI credentials (Terminal: Modify Credentials privilege). |
| Change Engineer: Medium | Allowed to author, approve, execute, and schedule scripts designated Medium Level (Level 2) and lower. Privileges include the following:
This role can launch SSH and Telnet sessions using NetMRIs Telnet/SSH Proxy feature (Terminal: Open Session privilege) using NetMRI default credentials. By default, this role cannot modify CLI credentials. |
| Change Engineer: Low | Allowed to author, approve, execute, and schedule scripts designated Low Level (Level 1). Privileges include the following:
Users with this role cannot launch SSH or Telnet sessions and those options will not appear in the device shortcut menu (right-clicking on a device's IP address, a VLAN IP, and other elements in the NetMRI UI). By default, this role cannot modify CLI credentials. |
| Config Admin | A read-only account that is allowed to view all sensitive data in NetMRI. Privileges include View: Audit Log, View: Sensitive, and View: Non-Sensitive. |
| Default View Role | A read-only account that is allowed to view only non-sensitive data. Privileges include View: Non-Sensitive. |
| Event Admin | Event system administrator. Privileges include Events: Admin which enables the creation of new Event Symptoms, and View: Non-Sensitive. |
FindIT | Allows access only to the NetMRI FindIT tool. |
| Group Manager | Creates and manages interface groups, device groups, and related result sets. Privileges include Groups: Create, Groups: Delete, Groups: Result Sets, View: Non-Sensitive, and View: Sensitive. |
| Network Security Engineer | Allows users to provision ACL / firewall rules. Privileges include the following:
|
| Policy Manager | Creates and manages Policies for one or more Groups in NetMRI to standardize and lockdown configurations for networked devices such as routers, switches, and firewalls. Privileges include Policy: Deploy, Policy: Create, Edit and Delete, View: Audit Log, View: Non-Sensitive, and View: Sensitive. |
| Report Admin | Role to allow the creation and editing of Report features in NetMRI. Associated privileges include Reports: Report Manager, View: Non-Sensitive, and View: Sensitive. |
| Switch Port Administrator | Allows users to make changes to switch port configurations. Privileges include the following:
|
| SysAdmin | The global administrator account Role for NetMRI. Includes the System Administrator privilege and View: Audit Log. SysAdmins can manage, add, and remove scan interfaces and map them to networks, manage, add, and remove network views. |
| User Admin | Create and edit NetMRI user accounts and Roles, and assign privileges. Includes View: Audit Log, View: Non-Sensitive, User Administrator, Reset Passwords, and Issues: Define Notifications. |
You can create custom Roles, with custom sets of privileges to suit the needs of your organization. You can add and remove privileges and user accounts from each of the pre-defined Roles in the NetMRI appliance. See Defining and Editing Roles for more information.
...
- Click Add User below the table.
- If you want the new account to be disabled by default, select the Account Disabled checkbox.
- If you want the user to be authenticated and authorized by the NetMRI appliance for their roles and device group assignments, select the Force Local Authorization checkbox. This enables the user to have a locally defined login that is separate from the remote one on the AAA server. Leaving this checkbox clear enables the user account to be subjected to authorization through a remote AAA server.
On the User Details tab, enter values for the First Name, Last Name, Username, and Password fields. Fill in optional fields as needed.
Note title Note
User account names are case-sensitive. You can use some non-alphanumeric characters for naming including bracket characters, such as @!#$%^&*()[]{}. Punctuation characters (,.;'"), the equal sign =, vertical bar |, and spacebar characters are disallowed.Note title Note
If you use TACACS+ authentication and authorization with NetMRI, keep in mind that TACACS user names are case-insensitive. Therefore, the case must not be the only difference between NetMRI and TACACS user names.- Click Save. The Roles, CLI Credentials, and Database Credentials tabs become available.
- Click the Roles tab, and then click Add.
- In the Add Role to User dialog, choose a role from the drop-down list.
- Under In device groups, click to choose the device group(s) the user is allowed to access.
- Click OK. The new role settings are saved for the user account.
- On the CLI Credentials tab, define the command-line credentials as described in the procedure below.
- On the Database Credentials tab, define the database credentials as described in the procedure below.
- In the Add New User dialog, click Close.
...
- In the Add New User or Edit User dialog, click the Database Credentials tab. This tab allows giving access to the NetMRI database to a user.
- Select the Database Credentials Enabled checkbox.
Enter the user's Username and Password values, and confirm the password. NetMRI uses these credentials for a new SQL user to access the database.
Note title Note The SQL username should be from 8 to 16 characters long. It should not contain special symbols.
- Click Save.
To edit an existing user account, complete the following:
...
- Click Add (below the table).
- In the Add Role dialog > Users tab, enter a descriptive name in the Name field.
- In the Description field, describe the role.
Click Save. This adds the new role to the Roles table. The Users and Privileges tabs appear.
...
...
You can assign one or more user accounts or privileges to the new role. It is not necessary to assign users to the role (this can be done in the user account), but privileges must be assigned for the new pole to be meaningful.
...
In the Users tab, click Add. The Add User for <Username> Role dialog appears, displaying a Users drop-down list and the list of Device Groups in the appliance.
...
In the Add User for <Username> Role dialog > User drop-down list, choose one or more users for the role.
...
In the Device Group table, select the device group checkboxes to be associated with this role.
...
Click OK.
...
As needed, repeat steps 5 through 8 for other accounts.
| Note | ||
|---|---|---|
| ||
A role containing optional user/device group definitions can be assigned only to users listed in the Role Users tab. To allow a role to be assigned to any user, delete user/device group definitions in this tab. |
...