Managing Access Control in PresSTORE
This article describes the functions to limit access for users in PresSTORE and discusses some scenarios as examples how to to configure non-administrator restore functions.
The PresSTORE Process Access Permissions
During installation, the PresSTORE job is set up to run with the highest privileges
possible. The PresSTORE process (nsd on Unix systems, nsd.exe on Windows) runs with the root account on Unix and with system account on Windows. This is necessary to read all files during sync and backup, please do not attempt to use this for own user
limitations.
Login Access to PresSTORE
Before working with PresSTORE via web GUI, a user has to authenticate by typing user name and password. This pair is then checked using operating system functions. PresSTORE does not maintain account information itself, instead it checks whether the user is permitted to login on the host where PresSTORE is running.
On Unix—like hosts (Mac, Linux, Solaris), the so called Pluggable Authentication Module is used for the check, so the authentication method used by the server can be influenced via PAM administration.
The Omnipotent Administrator Account
The administrator accounts in PresSTORE are omnipotent, each administrator has unlimited access to PresSTORE's web GUI.
The following sketch shows the groups that enjoy administrator privileges in PresSTORE:
The groups are identified by their name except for the group 544 on Windows which is identified by its group id because the name changes with the localization.
In addition to these group memberships, the special user root (identified by name or, on Unix hosts, by the UID 0) is also administrator in PresSTORE.
The Operator Account
PresSTORE supports one more special account type: the Operator. This type of account is intended for non-administrator users who are allowed to maintain jobs and media.
Operators in PresSTORE are users who a members of the operating system level user group psops or PrnAdm. The group psops usually does not exist, the group PrnAdm exists on Helios servers.
Operators are permitted to
● start and stop jobs in PresSTORE ● run jukebox inventories
● move media to or from the mail slot in a jukebox ● label tapes
All other permissions of operators are the same as for normal users.
Access Control Functions in PresSTORE
Access control for users is maintained based on so called login areas. After login, the user will see only those login areas he/she may access. By permitting access to a login area, users are at the same time permitted to use the functions within a login area. Permissions for login areas are maintained on user group level. Please note that there is one special group named root that stands for “all administrators”, even if that root group does not exist on the operation system, e.g. as on Windows.
Furthermore, user preferences allow to set up restrictions on a user base, these restrictions are applied to the user logged in.
The following PresSTORE resources handle access permissions:
Login areas may be restricted to users belonging to configured operating system level groups. This means that the login area remains invisible for other users.
User preferences may restrict access permissions for each user. E.g. specific users may have access only to one login area (usually their own backup), while others have no such restriction.
Default user preferences can be preset by adopting the generic user preferences template.
Example: Allow restore operations of user's own data
This example shows a typical network with multiple workstation users.
Each user shall be permitted to restore his data from backup, but users shall not get access to other users data and the restore shall write to a predefined folder only. Access to other backups or archives shall be denied.
This setup can be achieved with the following steps:
● Create a Login Area for each user. Select the according backup index and set
path to the path of the user's backup.
● In the User Preferences for the according user, remove download and archive
from the list of Allowed operations and set the Login behavior to the above login area.
Example: Allow Archive and Restore Operations on Servers
This example assumes an archive solution of two servers.
Each user shall be permitted to archive data with one archive index, and all users may restore data to a specific folder on each server.
This setup can be achieved with the following steps:
● Restrict access to all login areas. Administrators may adopt PresSTORE's method to
restrict the access of the login areas General Setup and Job and Storage
Management to members of group root by setting Allow access for group(s) in all login areas to group root.
● Grant access to the required Archive Plan by adding a user group to the according
login area. If no group for these users exists, it is possible to create a new group, e.g. archivists in the operating system and declare users as members of that group.
● In the Client setup for the two servers, navigate to the Additional Options and
set the Paths to restore to the desired folder. In case multiple paths are entered, users may select one of these before restore.
