Subject: Problems with Access Lists

From: Richard Passman <[email-masked]>
Date: Mon, 19 Feb 2007 13:24:27 +0000

Just doing some tests with the Dev Versions;  (20070218)

Users file
/argus        any        Top    root
cust1    any    Top:Customers:Cust1        cust1/

Config file
(top of 01-header)
/acl_root:    root
acl_staff: root
acl_user:    root

bkgimage:    /images/argus.logo.gif/
etc
etc

03-Customers file

/Group "Customers" {
    Group "Cust1" {
        acl_user: cust1
        acl_staff:    cust1
        #acl_root:    cust1
        #acl_page:    cust1
        #acl_about: cust1
        #acl_ntfyack:    cust1
        #acl_ntfylist:    cust1
        #acl_ntfyack: cust1
        #acl_ntfyackall: cust1
        #acl_ntfydetail: cust1
        graph: yes
        notify:    mail:[email-masked]
        sendnotify:    yes
   
        Group "Reading1 Office" {
            frequency: 60
            graph: yes
            Host "WAN1" {
/
etc

The problem is if I use the config as above, after logging in the cust1 
then I get an access denied, If I uncomment the acl_page then I can get 
to the page. If I uncomment the acl_ntfy** then I get the buttons to 
look at the notify lists but again access is denied.

Any help- my understanding of the acl's is that I should be able to see 
the page with the config above? - Should I not be using the very latest!!

Thanks

Richard Passman
Technical Director
Radime Media Networks

---

From: Richard Passman <[email-masked]>
Date: Mon, 19 Feb 2007 14:08:27 +0000

Just removed

acl_root:    root
acl_staff: root
acl_user:    root

from the top of 01-header file.

Now the acl_user:   cust1 works as expected
as does acl_staff:   cust1 but it still doesn't allow access to the 
notify lists

Thanks

Richard

Richard Passman wrote:
> The problem is if I use the config as above, after logging in the 
> cust1 then I get an access denied, If I uncomment the acl_page then I 
> can get to the page. If I uncomment the acl_ntfy** then I get the 
> buttons to look at the notify lists but again access is denied.
>
> Any help- my understanding of the acl's is that I should be able to 
> see the page with the config above? - Should I not be using the very 
> latest!!
>
> Thanks
>
> Richard Passman
> Technical Director
> Radime Media Networks
>
> _______________________________________________
> http://argus.tcp4me.com/
> [email-masked]
> http://www.tcp4me.com/mailman/listinfo/arguslist

---

From: Richard Passman <[email-masked]>
Date: Tue, 20 Feb 2007 18:14:01 +0000

Some more info;

See full config below

Using version 3.4 this config almost works;
(Users file needs an extra entry for the cust2 entry to be valid!)
i.e.user argus can get to everything,
user cust1 can just look at the data for cust1
user cust2 can look and has the buttons for notifys, but gives a 
permissions error when trying to access the notifylists

Using version Dev-20070218 subtle differences
user cust1 gets a permissions error when trying to look at its top page 
'Top:Cust1"
adding a "acl_page:    cust1" solves this problem, but even adding an 
acl_ntfylist won't let the user see the notifys list
Same with cust2

So have I found some bugs in the acl? or have I just not got it

Thanks

Richard

p.s. I can make the server available if anyone can help

Users File
argus        any        Top    root
staff    any         Top        staff
cust1    any    Top:Cust1    cust1
cust2    any    Top:Cust2    cust2
cust3    any    Top:Cust3    cust3

Config File
acl_user:    user staff root
 acl_staff:    staff root
 acl_root:    root

# locations of various items on web pages
sirensong:    /sound/whoopwhoop.wav
bkgimage:    /img/argus.logo.gif
icon:        /img/smile.gif
icon_down:    /img/sad.gif
nospkr_icon:    /img/nospkr.gif
style_sheet:    /argus.css
chmod_control:    777

# send messages to syslog
syslog:        daemon

# who should be notified when things break?
notify:        mail:[email-masked]

# don't summarize notifications
nolotsmsgs:    yes

# enable built in tcp test port
test_port:    3074

# enable built in resolver
Resolv

Group "Root" {
            frequency: 60
            graph: yes
            Host "WAN1" {
                hostname: 217.169.19.55
                Service Ping
               
            }
}
Group "Cust1" {
            acl_user:    cust1
            frequency: 60
            graph: yes
            Host "WAN1" {
                hostname: 81.2.98.156
                Service Ping
               
            }
}
Group "Cust2" {
            acl_user:    cust2
            acl_staff:        cust2
            frequency: 60
            graph: yes
            Host "WAN1" {
                hostname: 81.2.102.65
                Service Ping
               
            }
}