RackTablesAdminGuide - Revision history

Michael.tiernan: /* File uploads */

2019-06-03T15:13:49Z

File uploads

Michael.tiernan: /* Notes about rules/permissions */

2019-05-06T18:52:16Z

Notes about rules/permissions

Michael.tiernan at 15:51, 6 May 2019

2019-05-06T15:51:17Z

Michael.tiernan at 11:46, 26 August 2018

2018-08-26T11:46:18Z

Michael.tiernan at 11:44, 26 August 2018

2018-08-26T11:44:13Z

Infrastation: Live VLANs is obsolete, remove the section.

2017-05-29T11:03:49Z

Live VLANs is obsolete, remove the section.

Grin: /* Defining a new RackTables Object Type */ update to the current, and format a bit

2016-04-29T10:11:54Z

Defining a new RackTables Object Type: update to the current, and format a bit

Infrastation: fix file name

2016-01-16T22:04:05Z

fix file name

Tleavitt: /* User authentication */ minor rewrite

2016-01-14T01:10:31Z

User authentication: minor rewrite

Tleavitt: /* Troubleshooting */ added mention of $debug_mode switch in secret.php

2016-01-14T01:09:35Z

Troubleshooting: added mention of $debug_mode switch in secret.php

@@ Line 398: / Line 398: @@
 = File uploads =
-There are several settings in php.ini which you may need to modify:
+There are several settings in the global /etc/php.ini which you may need to modify:
 ;file_uploads
 : needs to be On
 ;upload_max_filesize
-: max size for uploaded files
+: max size for uploaded files (Defaults to 2MB)
 ;post_max_size
 : max size of all form data submitted via POST (including files)

@@ Line 317: / Line 317: @@
 ### will be permitted to look at things without being able to change anything
 ### but *can* change their own password.
-allow {$page_myaccount} and not {$tab_qlinks} and not {$tab_interface}
+allow {$page_myaccount} and {$tab_mypassword}
 </pre>

@@ Line 286: / Line 286: @@
 (This list is not exhaustive and may inadvertently exclude some edge cases.)
 * Rules are read from top to bottom.
-** To reach the bottom of the rules, no others have had to match.
+** To reach the bottom of the rules, no others have had to match. This also means that a matched rule ends the search.
 * Rulesets permit (and encourage):
 ** Comments which start with a pound sign "#".

@@ Line 283: / Line 283: @@
 == Notes about rules/permissions ==
 (This list is not exhaustive and may inadvertently exclude some edge cases.)
 * Rules are read from top to bottom.

← Older revision		Revision as of 11:44, 26 August 2018
Line 281:		Line 281:

	4. Navigate to the Production network under IPv4space section. Click the network, and confirm that the "LivePTR" tab is not available.		4. Navigate to the Production network under IPv4space section. Click the network, and confirm that the "LivePTR" tab is not available.
		+
		+	== Notes about rules/permissions ==
		+	(This list is not exhaustive and may inadvertently exclude some edge cases.)
		+	* Rules are read from top to bottom.
		+	** To reach the bottom of the rules, no others have had to match.
		+	* Rulesets permit (and encourage):
		+	** Comments which start with a pound sign "#".
		+	** Blank lines before/after rules or logical sections.
		+	** Comments may also be placed at the end of a rule by using "#" to begin the comment.
		+	* <i><b>Rules can get you into trouble.</b></i><br>Good practice suggests you have two different browser windows open at the same time, one logged in as the 'admin' changing the rules and the other as an ordinary user testing these rules.
		+	* Rules specifying things like "Locations" (see below) can be created by:
		+	<br>(I suggest doing this for your admin user only.)
		+	# Go to "My Account" under the configurations tab.
		+	# Select "Interface Preferences"
		+	# Search for <code><b>SHOW_AUTOMATIC_TAGS</b></code> and set it to "Yes"
		+	# Save your changes.
		+	# Go to the "RackTables" page from the Main page and select the location in question. You will be shown a line that will read something like <br><code>Automatic tags: $any_location, $locationid_43</code><br>telling you what tag represents your location.
		+
		+	Examples of using comments in permissions:
		+	<pre>allow {$userid_1} # Our "admin" user.</pre>
		+
		+	This rule references the tag "$locationid_43" which (for this example) is the automatic tag related to the Boston datacenter location.
		+	<pre>#
		+	# Rule added: Thu Aug 23 08:22:10 EDT 2018 by MrTux
		+	# The user Jack is the new manager and admin at our floating facility off of Boston.
		+	allow {$username_jack} and {$locationid_43} # Jack has no restrictions in Boston.
		+
		+	# Bill is a datacenter worker in Washington DC and we don't want to give him any
		+	# power other than to see what's on the default tabs.
		+	allow {$username_bill} and {$tab_default} and {$locationid_55} # Bill can only view.</pre>
		+
		+	<pre># This rule should be way down the end.
		+	### It says that a user (that did not match any rules above, i.e. ordinary view-only user)
		+	### will be permitted to look at things without being able to change anything
		+	### but can change their own password.
		+	allow {$page_myaccount} and not {$tab_qlinks} and not {$tab_interface}
		+	</pre>

	= Defining a new RackTables Object Type =		= Defining a new RackTables Object Type =

← Older revision		Revision as of 11:03, 29 May 2017
Line 153:		Line 153:

	The feature can also make its work later. When you browse an object, which has no ports yet, but could have (according to AutoPorts configuration), you see additional tab named "AutoPorts". It will present you with its idea of which records could be added, and a button to do so. Once you add any ports to an object by automatic or manual mean, the tab will hide itself.		The feature can also make its work later. When you browse an object, which has no ports yet, but could have (according to AutoPorts configuration), you see additional tab named "AutoPorts". It will present you with its idea of which records could be added, and a button to do so. Once you add any ports to an object by automatic or manual mean, the tab will hide itself.
−	~~----~~
−
−	~~= Live VLANs =~~
−	RackTables can be used to ease access switches management by presenting a user with current VLAN membership for each switch port and letting him change the configuration and submit for instant activation. This functionality was implemented through a "gateway" for Cisco devices with an intention to add more vendor support later. Configuration consists of several steps:
−	~~# Pick a [Cisco Catalyst] switch and set its hardware and software types in Properties. This will trigger the "Live VLANs" tab to appear for this object.~~
−	# Decide on the so called "endpoint", which will be used to connect to the device. The safest approach is to have FQDN sticker set for each switch. However, if you always have one (and only one) IP address listed for each managed switch, you can omit setting FQDN, because the IP address will be used. Furthermore, if you don't list IPv4 allocations at all (not a good idea), object's common name is the last resort for the endpoint. If more than 1 IP address is listed, FQDN is a mandatory attribute to set.
−	~~# Change to the gateways/switchvlans directory and prepare gateway's own configuration files. The syntax should be straightforward, it isn't the best possible, but it lets configure things.~~
−	~~<pre>~~
−	~~$ cp cisco.secrets.php-sample cisco.secrets.php~~
−	~~$ cp userauth.php-sample userauth.php~~
−	~~$ touch changes.log~~
−	~~$ chmod 666 changes.log # to keep track of changes~~
−	~~$ vi cisco.secrets.php userauth.php~~
−	~~</pre>~~
−	~~# Get back to browser, click the Live VLANs tab and enjoy.~~
	----		----

@@ Line 306: / Line 306: @@
 This process has been discussed from time to time on the mailing list.  Here's how you do it:
-* From the Main Menu, select Configuration, Dictionary, and then select the dictionary "RackObjectType".
+* From the Main Menu, select Configuration, '''Dictionary''', and then select the dictionary '''"ObjectType"'''.
 * Select "Edit" and add the new object type that you wish to create.  I extended RackTables to support circuits, so I typed in "Circuit".
 Now you need to create a dictionary entry that will be used to tie attributes to.
-* From the Main Menu, select Configuration, Dictionary, and then select "Manage Chapters" at the top. Add a new entry (Circuit ID as my example).
+* From the Main Menu, select Configuration, '''Dictionary''', and then select '''"Manage Chapters"''' at the top. Add a new entry (Circuit ID as my example).
 You can now create the attributes that will be assigned to your new dictionary entry.  For a circuit, things like circuit ID#, carrier, AS#, contact name, etc.  You can always go back and add more attributes as needed.
-* From the Main Menu, select Configuration, Attributes, and Edit Attributes.  Create each attribute that you need.  Take care in the '''type''' of attribute.  "String" is probably what you want, when in doubt.
+* From the Main Menu, select Configuration, '''Attributes''', and '''Edit Attributes'''.  Create each attribute that you need.  Take care in the '''type''' of attribute.  "String" is probably what you want, when in doubt.
 You're just about done.  It's time to assign those new attributes to the dictionary entry.
-* From the Main Menu, select Configuration, Attributes, and Edit Map.  Select the new attributes and apply it to the new dictionary entry.  You probably do not need to do anything with the third dropdown box, "dictionary chapter...".
+* From the Main Menu, select Configuration, '''Attributes''', and '''Edit Map'''.  Select the new attributes and apply it to the new dictionary entry.  You probably do not need to do anything with the third dropdown box, "dictionary chapter...".
 Now you should be able to go back to the Main Menu, and create some new objects with your new Object Type.

@@ Line 1: / Line 1: @@
 = User authentication =
-Authentication is a way to tell that the remote user is who he or she purports to be. This can be done in three ways, with or without knowing the user's password, and is controlled through an option on the configuration page and via editing parameters in the "secrets.php" file in the "inc" folder of your installation. Authentication does not automatically equate to access. All users other than the default "admin" user must be explicitly granted access, either individually, or via group permissions (see the "Permission configuration" section below), as specified under "Configuration: Permissions". If you do not grant access, the user will not be permitted to view any pages. !RackTables traditional account locking works regardless of authentication sources, so one can always disable accounts one by one, if necessary.
+Authentication is a way to tell that the remote user is who he or she purports to be. This can be done in three ways, with or without knowing the user's password, and is controlled through an option on the configuration page and via editing parameters in the "secret.php" file in the "inc" folder of your installation. Authentication does not automatically equate to access. All users other than the default "admin" user must be explicitly granted access, either individually, or via group permissions (see the "Permission configuration" section below), as specified under "Configuration: Permissions". If you do not grant access, the user will not be permitted to view any pages. !RackTables traditional account locking works regardless of authentication sources, so one can always disable accounts one by one, if necessary.
 == Local authentication ==
@@ Line 387: / Line 387: @@
 = Troubleshooting =
-Adding the following parameter to "secrets.php" will enable debugging, which is helpful in tracking down permissions errors (for example).
+Adding the following parameter to "secret.php" will enable debugging, which is helpful in tracking down permissions errors (for example).
 <pre>

← Older revision		Revision as of 01:09, 14 January 2016
Line 384:		Line 384:
	The following MySQL server parameter may be relevant too:		The following MySQL server parameter may be relevant too:
	;max_allowed_packet		;max_allowed_packet
		+
		+	= Troubleshooting =
		+
		+	Adding the following parameter to "secrets.php" will enable debugging, which is helpful in tracking down permissions errors (for example).
		+
		+	<pre>
		+	$debug_mode= 1;
		+	</pre>
		+
		+	Make sure you disable this by commenting it out or deleting it when you're done debugging! :)