The structure of the web interface

The web interface consists of the following main sections:

Supported web browsers and operating systems

Main menu: Each menu item displays its options in the main workspace on one or more tabs. Click in front of a main menu item to display the list of available tabs.

Figure 4.1. Structure of the web interface

User menu: Provides possibilities to change your SSB password; to log out; and disable confirmation dialogs and tooltips using the Preferences option.

User info: Provides information about the user currently logged in:

■ User: username

■ Host: IP address of the user's computer

■ Last login: date and IP address of the user's last login

Figure 4.2. User menu and user info

System monitor: Displays accessibility and system health information about SSB, including the following:

The structure of the web interface

Figure 4.3. System monitor

■ Time: System date and time.

■ Remaining time: The time remaining before the session to the web interface times out.

Note

To change timeout settings, navigate to Basic Settings > Management > Web interface timeout and enter the timeout value in minutes.

■ Locked: Indicates that the interface is locked by another administrator (for details, see Section 4.2.2, Multiple web users and locking (p. 35))

■ Modules: The status of syslog-ng running on SSB (ideally it isRUNNING).

■ License: License information if the license is not valid, or an evaluation version license has expired.

■ Raid status: The status of the RAID devices, if synchronization between the disks is in progress.

■ Active:

• Hosts: the number of clients (log source hosts) where the log messages originate from (for example computers)

• Senders: the number of senders where the log messages directly come from (for example relays)

The structure of the web interface

Example 4.1. Number of hosts and senders

For example: if 300 clients all send log messages directly to SSB the Hosts and Senders are both 300.

If the 300 clients send the messages to 3 relays (assuming that the relays do not send messages themselves) and only the relays communicate directly with SSB then Hosts is 300, while Senders is 3 (the 3 relays).

If the relays also send messages, then Hosts is 303, while Senders is 3 (the 3 relays).

■ HA:The HA status and the ID of the active node if two SSB units are running in a High Availability cluster. If there are redundant Heartbeat interfaces configured, their status is displayed as well. If the nodes of the cluster are synchronizing data between each other, the progress and the time remaining from the synchronization process is also displayed.

■ Average system load during the

• Load 1: last minute

• Load 15: last fifteen minutes

■ CPU, memory, hard disk, and swap use. Hover the mouse above the graphical bars to receive a more details in a tooltip, or navigate to Basic Settings > Dashboard for detailed reports.

The System monitor displays current information about the state of SSB. To display a history of these parameters, go to Basic Settings > Dashboard. For details, see Section 16.5, Status history and statistics (p. 227).

4.2.1. Elements of the main workspace

The main workspace displays the configuration settings related to the selected main menu item grouped into one or more tabs. Related parameters of a tab are organized into labeled groups or sections, marked with blue

outline .

Figure 4.4. Main workspace

■ Each page includes one or more orange action buttons. The most common action button is the , which saves and activates the changes of the page.

■ / Show/Hide Details: Displays or hides additional configuration settings and options.

■ , Create entry: Create a new row or entry (for example an IP address or a policy).

Elements of the main workspace

■ , Delete entry: Delete a row or an entry (for example an IP address or a policy).

■ , Open/collapse lists: Open or close a list of options (for example the list of available reports).

■ Modify entries or upload files: Edit an entry (for example a host key, a list, and so on), or upload a file (for example a private key). These actions open a popup window where the actual modification can be performed.

■ , Position an item in a list: Modify the order of items in a list. The order of items in a list (for example the order of connections, permitted channels in a channel policy, and so on) is important because when SSB is looking for a policy, it evaluates the list from top to down, and selects the first item completely matching the search criteria. For example, when a client initiates a connection to a protected server, SSB selects the first connection policy matching the client's IP address, the server's IP address, and the target port (the From, To, and Port fields of the connection).

Message window: This popup window displays the responses of SSB to the user's actions, for example Configuration saved successfully. Error messages are also displayed here. All messages are included in the system log. For detailed system logs (including message history), see the Troubleshooting tab of the Basic menu. To make the window appear only for failed actions, navigate to User menu > Preferences and enable the Autoclose successful commit messages option.

Figure 4.5. Message window

4.2.2. Multiple web users and locking

Multiple administrators can access the SSB web interface simultaneously, but only one of them can modify the configuration. This means that the configuration of SSB is automatically locked when the first administrator who can modify the configuration accesses a configuration page (for example the Basic Settings, AAA, or Logs menu). The username and IP address of the administrator locking the configuration is displayed in the System Monitor field. Other administrators must wait until the locking administrator logs out, or the session of the administrator times out. However, it is possible to access the Search and Reporting menus, or browse the configuration with only View rights (for details, see Section 5.6, Managing user rights and usergroups (p. 77)).

Note

If an administrator logs in to SSB using the local console or a remote SSH connection, access via the web interface is completely blocked. Inactive local and SSH connections timeout just like web connections. For details, see Section 6.4, Accessing the SSB console (p. 103).

4.2.3. Web interface timeout

By default, SSB terminates the web session of a user after ten minutes of inactivity. To change value of this timeout, adjust the Basic Settings > Management > Web interface timeout option.

Multiple web users and locking

Figure 4.6. Web interface timeout