On Wed, Jul 20, 2005 at 12:56:24PM -0400, Peter Murray wrote:
In our quest for a more distributed environment, we have a need to allow a select group of users the ability to acknowledge alerts, but do NOT want to give those users the ability to enable/disable any of the services. It appears that a given userID/password will allow both. Is there any way we can restrict this to disallow the enable/disable ability for some but not all?
This is more of an Apache access-control question, since Hobbit doesn't implement any access controls by itself. I'm no expert on this, but one way it could be done was to simply move the acknowledge CGI to a different directory, and then instead of the "Require valid-user" directive in the apache setup you'd use a "Require group enableusers" and "Require group acknowledgeusers".
To be more specific: Your hobbit homedirectory currently has:
henrik at osiris:/usr/lib/hobbit$ ls -CFR cgi* cgi-bin: bb-csvinfo.sh* bb-eventlog.sh* bb-histlog.sh* bb-hostsvc.sh* bb-rep.sh* hobbitcolumn.sh* bb-datepage.sh* bb-findhost.sh* bb-hist.sh* bb-replog.sh* bb-snapshot.sh* hobbitgraph.sh*
cgi-secure: bb-ack.sh* hobbit-enadis.sh*
Create a new directory, let's say "cgi-ack", and move the bb-ack.sh script there, so you have
henrik at osiris:/usr/lib/hobbit$ ls -CFR cgi* [...] cgi-ack: bb-ack.sh*
cgi-secure: hobbit-enadis.sh*
The bb-ack.sh CGI is only referenced from the Hobbit menu, so just edit ~hobbit/server/www/menu/menu_items.js and change the URL for the bb-ack.sh script to the new directory.
In your Apache config, copy the section for the "cgi-secure" directory and make an identical for the "cgi-ack" directory. Then, change the authorization section: By default, it's
AuthUserFile /etc/hobbit/hobbitpasswd
AuthType Basic
AuthName "Hobbit Administration"
Require valid-userFor the cgi-secure directory, make that
AuthUserFile /etc/hobbit/hobbitpasswd
AuthGroupFile /etc/hobbit/hobbitgroup
AuthType Basic
AuthName "Hobbit Administration"
Require group disablersand for the cgi-ack directory it will be
AuthUserFile /etc/hobbit/hobbitpasswd
AuthGroupFile /etc/hobbit/hobbitgroup
AuthType Basic
AuthName "Hobbit Administration"
Require group ackers disablersSo you add an AuthGroupFile line, and change the "Require" from "valid-user" to a specific group of users.
The only thing left then is to setup the /etc/hobbit/hobbitgroup file. This is a text file - each group ("disablers" and "ackers") go on a line by itself, followed by a colon and then a list of the users who belong to each group. A single user can be in multiple groups.
So e.g.
disablers: pmurray ackers: jdoe
The "pmurray" user now can access both the cgi-secure and the cgi-ack directories, the "jdoe" user can access only the cgi-ack directory.
Regards, Henrik