In addition to giving you the tools to create sophisticated Graphs, Cacti enables you to manage User and User Group access to those Graphs as well as various other areas of Cacti. Each User has a variety of settings and permissions. Some of these settings can be controlled by the individual User via editing their Profile, or controlled by the Cacti Administrator. A Users Cacti permissions are only modifiable by authorized Cacti Administrators.
Note: for a users to see new settings, they will have to log off and back in again to view.
Out of the box, there are two users that come with every Cacti installation. The "admin" user - the main user that by default has access to see and change everything in Cacti. This is the user that you first login with in Cacti, and it is probably a good idea to keep around unless you know otherwise. The second user is the "guest" user, which controls which areas/graphs are allowed for unauthenticated users. By default this user only has rights to view, but not change graphs. This enables any unauthenticated user to visit 'graph_view.php' and view your graphs. This behavior can be changed by either changing the realm permissions for the "guest" user, or disabling the guest user altogether under Cacti Settings. By default in 0.8.7 and later, the "guest" user is not enabled, effectively disabling "guest" (Unauthenticated) access to Cacti.
To edit an existing user, select the User Management item under the Utilities heading on the Cacti menu. Once at the user management screen, click username of the user you wish to edit. You will see a screen that looks similar to the image below.
At minimum, you must specify a User Name and a Password for each user. Each user field is described in more detail below. In addition to these fields, each user can have their own realm permissions", graph permissions, and graph settings. Each of these items are described in this section of the manual.
User Name
This field contains the login name for the user. There are no character limits this field, but it would make sense to keep it to alphanumeric characters to maintain simplicity.
Full Name
(Optional) You can use this field as a more descriptive identifier for the user. It is currently only used for display on the user management page.
Password
Enter the password for the user twice, once in each text box. Keep in mind that passwords are case sensitive and the password will remain unchanged if the boxes are both left empty.
Account Options
There are two account related options that can be set for each user.
User Must Change Password at Next Login
Force a password change immediately after the user logs in.
Allow this User to Keep Custom Graph Settings
Allows user to maintain their own custom graph viewing settings.
Graph Options -
Enables certain defined graph viewing options.
User Has Rights to Tree View
User Has Rights to List View
User Has Rights to Preview View
Login Options
These options set what occurs after the user logs in.
Show the page that user pointed their browser to
Will point the user to whatever page they were heading to before being interrupted by the login page.
Show the default console screen
This option will always point the user to 'index.php' after a successful login.
Show the default graph screen
This option will point the user to default graph view after login.
Authentication Realm
This setting allows you to specify a user for use with Local, Web Basic or
LDAP Authentication.
Note: Template users must be Local.
Realm permissions control which areas of Cacti a user can access. You can edit a user's realm permissions by selecting User Management and choosing the user you want to edit the permissions for. The Realm Permissions box will be displayed in the lower part of the screen. Each "realm" is a grouping that represents common tasks in Cacti, making it easier to fine tune each user's access.
If you want to create a user that can only view graphs, you should select the View Graphs realm and leave everything else unchecked. See the Graph Permissions section for more information about how to fine tune this even more on a per-graph basis. Conversely, if the user needs to access the console, they will need Console Access and any additional realms that you see fit.
Graph Permissions control which graphs a user is allowed to view. However, in general, these permissions do not apply to editing graphs. You can edit a Users Graph Permissions either by assigning that User to one to many User Groups, or by modifying their Graph Permissions directly.
Cacti supports two Graph Permission models. There is the Permissive Graph
permission which states that if a user has access either to the Graph, the
Device or Graph Template, the user will have access to all the Graphs that match
that class. For example, in the Permissive model, if you have access to the
Device, you have access to all it's Graphs. If you have access to a
Graph Template, you have access to every Device Graph that matches that
Graph Template.
The second Graph Permission model is Restrictive. In the Restrictive Graph
permission model, you must have access either to the Graph directly, or both
the Device and Graph Template. Using this permission model requires the
Users and User Groups have much more specific access if they want to
gain access to various device Graphs.
We introduced these new permission models and administrative processes to simplify the Cacti permission system, and to increase it's usability.
In addition to the Permissive and Restrictive models, which can be set from
Console > Configuration > Settings > General, a User or User Group
is either Allowed or Denied all Graphs*, Devices and Graph
Templates through a setting called the Default Policy in each of the
Permission Tabs. The Graph Permissions tab includes an Effective Policy,
which combines all the Users various *User Group and User permissions
to provide an effective permission. If the Graph is ultimately permitted
for the User** to view, you will see for what reason from this Permission tab.
Note: even if a User is denied access to a Device or Graph Template, but has access to at least one Graph from that Device or Graph Template, they will see that Device or Graph Template name in areas of Cacti that display it.
Device Permissions allow you to Grant or Revoke access to specific
Devices. If you wish to Grant or Revoke access to a Device, you can
select it, and then choose the specified action from the drop down, and press
the Go button to make that permission change. As mentioned above, revoking
Device access does not necessarily block a User from seeing that
Device from the User Interface.
Template Permissions allow you to Grant or Revoke access to specific
Graph Templates. If you wish to Grant or Revoke access to a Graph
Template, you can select it, and then choose the specified action from the
drop down, and press the Go button to make that permission change. As
mentioned above, revoking Graph Template access does not necessarily block a
User from seeing that Graph Template from the User Interface.
Cacti allows the Administrator to Grant and Revoke Tree permissions from
this tab. The Cacti Tree permissions are a single level security object.
However, when you browse a Tree to it's various branches, a user will only
be allowed access to the Graphs and Devices that they have access to. Managing
permissions to Trees is identical to Graphs, Devices and Graph
Templates otherwise. Additionally, Cacti has will hide branches from a
User when they have no access to any Devices or Graphs within it.
Cacti optionally allows Users to control certain User Settings such as
their Email Address and Full Name. However, the Cacti Administrator also
has the ability to view a Users settings and modify them for the User
from the User Settings tab. This feature allows the Cacti Administrator to
better support their Users. However, you can disable a Users ability to
modify defaults from the General User Management tab. This is important
for the guest account for example.
In order to increase Cacti User Interface performance, when a User first checks for their permissions after login to either Devices or Graph Templates those permissions are cached for their entire login session. If you change a Users Device or Graph Template permissions, they will not see those permission changes until their next login.
To create a new user, select the User Management item under the Utilities heading on the Cacti menu. Once at the user management screen, click the plus (+) glyph.
At minimum, you must specify a User Name, Password and Login Realm for
each user. Each User field is self documented either below the field, or in
the help bubble to the right of it. In addition to the fields on the General
tab, settings can be controlled from the various sub-tabs when editing a user.
Those sub tabs include:
From this sub-tab, you can modify general User attributes including Full Name, Email Address, Lockout status, Account Options, Graph Options, etc.
From this sub-tab, you control what areas of Cacti a User has access to.
Cacti has broken those access areas into various Roles to make the setting of
permissions easier to understand. Note that Plugin permissions are still
grouped by Plugin in the current version of Cacti. This will change over the
next few releases to be more in line with the various Cacti Roles.
From this sub-tab, you can assign or remove users from various User Groups.
From this sub-tab, you can view a users Effective Graph permissions and also
Grant or Revoke access to Graphs for an individual User.
From this sub-tab, you can view and edit a users Device permissions. Note that removing a users permission to a Device can be overridden if they have access to either a Graph or, depending on the permission model you have chosen, a Devices Graph Template.
From this sub-tab, you can Grant or Revoke a Users access to various
Cacti Graph Templates.
From this sub-tab, you can Grant or Revoke a Users access to the various
Cacti Trees.
From this sub-tab, you can modify a Users settings to assist the User with their use of Cacti, or to set defaults for that User.
To copy a User to a new one, go to Console > Configuration > Users. Once
at the Users interface, highlight the User you would like to copy from
and select Copy from the Choose an action drop down selection box, click
Go to continue. If you select multiple users, only the first selected User
will be used as the source User.
Specify the New Username, New Full Name and New Realm of the new user. Click
Continue to copy the selected template user to the the designated new user. An
error will be returned if you attempt to copy over an existing user. If you
would like to copy over an existing user, use Batch Copy.
To enable or disable a set of or a single user, select the User Management item
under the Utilities heading on the Cacti menu. Once at the Users interface,
highlight the User you would like to Enable or Disable and select either
Enable or Disable from the Choose an action drop down selection box, click
Go to continue.
Confirm that you want to disable or enable the listed users. Click Continue to
perform the action. Disabling your own account is not permitted.
Batch Copy is a helpful utility that helps Cacti Administrators maintain users. Because Cacti does not yet support groups, it is important that there is some way to mass update users. This what Batch Copy does for you.
To Batch Copy a set of or a single user, select the Users interface under
Console > Configuration. Once at the Users interface, highlight the
Users you would like to batch copy information to and select Batch Copy
from the Choose and action drop down selection box, click Go to continue.
Select the Template User and confirm that you want to Batch Copy the listed
Users. Click Continue to perform the action.
It is important to note that when using Batch Copy the original Users
Full Name, Password, Login Realm and Enable status will be retained, all
other fields will be overwritten with values from the selected Template User.
To delete a set of or a single User, highlight the Users from **Console
Configuration > Users** interface, then select
Deletefrom theChoose an actiondrop down selection box and pressGoto continue.
Confirm that you want to delete the listed users. Click Continue to perform
the action. Deleting your own account is not permitted.
By default, Guest or Anonymous access is disabled in Cacti. Enabling "Guest" access is easy. But, you must understand that you should only allow the designated "Guest" user access to what you authorized. It is not suggested that you give the designated "Guest" user more than just access to graphs. To enable guest access, first, need a designated "Guest" user. Cacti by default comes with one already created that has access to only graphs.
It is important to note that the default guest user has access to all graphs on the system. Once you have created the "Guest" user, you need to tell Cacti what the "Guest" user is. This is done by updating the Authentication Settings and selecting the "Guest" user you have designated. The "Guest" user must be enabled and be set as the guest user for anonymous access to work.
Cacti®