{"id":5586,"date":"2015-05-25T19:26:15","date_gmt":"2015-05-25T09:26:15","guid":{"rendered":"http:\/\/nsrd.info\/blog\/?p=5586"},"modified":"2015-05-25T19:26:15","modified_gmt":"2015-05-25T09:26:15","slug":"basics-configuring-a-reports-only-user","status":"publish","type":"post","link":"https:\/\/nsrd.info\/blog\/2015\/05\/25\/basics-configuring-a-reports-only-user\/","title":{"rendered":"Basics &#8211; Configuring a reports-only user"},"content":{"rendered":"<p>Something that&#8217;s come up a few times in the last year for me has been a situation where a NetWorker user has wanted to allow someone to access\u00a0NetWorker Management Console for the purpose of running reports, but not allow them any administrative access to NetWorker.<\/p>\n<p>It turns out it&#8217;s very easy to achieve this, and you\u00a0actually have a couple of options on the level of NetWorker access they&#8217;ll get.<\/p>\n<p>Let&#8217;s look first at the minimum requirements \u2013 defining a\u00a0<em>reports only<\/em> user.<\/p>\n<p>To do that, you first go into NetWorker Management Console as an administrative user, and go across to the\u00a0<em>Setup<\/em> pane.<\/p>\n<p>You&#8217;ll then create a new user account:<\/p>\n<p><a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/Screen-Shot-2015-05-25-at-18.55.24-.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5587\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/Screen-Shot-2015-05-25-at-18.55.24-.png\" alt=\"New User Account in NMC\" width=\"434\" height=\"294\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/Screen-Shot-2015-05-25-at-18.55.24-.png 434w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/Screen-Shot-2015-05-25-at-18.55.24--300x203.png 300w\" sizes=\"auto, (max-width: 434px) 100vw, 434px\" \/><\/a><\/p>\n<p>Within the Create\u00a0User dialog, be certain to\u00a0<em>only<\/em> select\u00a0<em>Console User<\/em> as the role:<\/p>\n<p><a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-new-user-dialog.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-5588\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-new-user-dialog.png\" alt=\"NMC new user dialog\" width=\"600\" height=\"468\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-new-user-dialog.png 898w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-new-user-dialog-300x234.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><\/p>\n<p>At this point, you&#8217;ve successfully created a user account that can run NMC reports, but can&#8217;t administer the NetWorker server.<\/p>\n<p><em>However<\/em>, you&#8217;re then faced with a decision. Do you want a reports-only\u00a0user that can &#8220;look but don&#8217;t touch&#8221;, or do you want\u00a0a reports-only user that can&#8217;t\u00a0<em>view<\/em> any of the NetWorker configuration (or at least, anything other than can be ascertained by the reports themselves)?<\/p>\n<p>If you want\u00a0your reports user to be able to run reports and you&#8217;re not fussed\u00a0about the user being able to view the majority of your NetWorker configuration, you&#8217;re done at this point. If however your organisation\u00a0has a higher security focus, you may need to look at adjusting the basic\u00a0<em>Users<\/em> NetWorker user group. If you&#8217;re familiar with it, you&#8217;ll know this has the following configuration:<a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NetWorker-Users-usergroup.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-5591\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NetWorker-Users-usergroup-1024x917.png\" alt=\"NetWorker Users Usergroup\" width=\"695\" height=\"622\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NetWorker-Users-usergroup-1024x917.png 1024w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NetWorker-Users-usergroup-300x269.png 300w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NetWorker-Users-usergroup-900x806.png 900w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NetWorker-Users-usergroup.png 1182w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/a><\/p>\n<p>This usergroup\u00a0in the default configuration allows any user in the NetWorker datazone to:<\/p>\n<ul>\n<li>Monitor NetWorker<\/li>\n<li>Recover Local Data<\/li>\n<li>Backup Local Data<\/li>\n<\/ul>\n<p>The key there is\u00a0<em>any user<\/em> &#8211; <strong>*@*. <\/strong>Normally you want this to be set to *@*,\u00a0but if you&#8217;re a particularly security focused organisation you might want to tighten this down to only those users and system accounts authorised to perform recoveries. The same\u00a0principle applies here. Let&#8217;s say I didn&#8217;t want the reports user to see any of the NetWorker configuration, but I did want any root, system or pmdg user in\u00a0the environment to still have that basic functionality. I\u00a0could change the Users usergroup to the following:<\/p>\n<p><a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/modified-NetWorker-users-usergroup.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-5593\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/modified-NetWorker-users-usergroup-1024x915.png\" alt=\"Modified NetWorker Users usergroup\" width=\"695\" height=\"621\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/modified-NetWorker-users-usergroup-1024x915.png 1024w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/modified-NetWorker-users-usergroup-300x268.png 300w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/modified-NetWorker-users-usergroup-900x804.png 900w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/modified-NetWorker-users-usergroup.png 1186w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/a><\/p>\n<p>With this usergroup modified, logging in as the reports user will show a very blank NMC monitoring tab:<\/p>\n<p><a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-monitoring-reports-user.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-5594\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-monitoring-reports-user-1024x625.png\" alt=\"NMC-monitoring reports user\" width=\"695\" height=\"424\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-monitoring-reports-user-1024x625.png 1024w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-monitoring-reports-user-300x183.png 300w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-monitoring-reports-user-900x549.png 900w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/a><\/p>\n<p>Similarly, the client list (as an example) will be quite empty too:<\/p>\n<p><a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-config-reports-user.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-5595\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-config-reports-user-1024x626.png\" alt=\"NMC-config reports user\" width=\"695\" height=\"425\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-config-reports-user-1024x626.png 1024w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-config-reports-user-300x183.png 300w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2015\/05\/NMC-config-reports-user-900x550.png 900w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/a><\/p>\n<p>Now, it&#8217;s worth mentioning there are is a key\u00a0caveat you should consider here \u2013\u00a0some modules may be\u00a0designed in anticipation that the\u00a0executing\u00a0user for the backup or recovery (usually an\u00a0application user with sufficient privileges) will at least be a member of the\u00a0<em>Users<\/em> usergroup. So if you tighten the security against your reports user to this level, you&#8217;ll need to be prepared to\u00a0increase the steps in your application onboarding processes to ensure those accounts are added to an appropriate usergroup (or a new usergroup).<\/p>\n<p>But in terms of\u00a0creating a reports user that&#8217;s not privileged to control NetWorker, it&#8217;s as easy as the steps above.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Something that&#8217;s come up a few times in the last year for me has been a situation where a NetWorker&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[16,21],"tags":[96,126,638,1234,822,1254],"class_list":["post-5586","post","type-post","status-publish","format-standard","hentry","category-networker","category-security","tag-administrator","tag-auditing","tag-nmc","tag-privileges","tag-reporting","tag-security"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pKpIN-1s6","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/5586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/comments?post=5586"}],"version-history":[{"count":4,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/5586\/revisions"}],"predecessor-version":[{"id":5596,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/5586\/revisions\/5596"}],"wp:attachment":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/media?parent=5586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/categories?post=5586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/tags?post=5586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}