Creating user groups
Instead of modifying the default user groups, we will add our own. Navigate to Administration | User groups?and take a look at the list of current user groups:
Let's create a new group for our user. Click on Create user group in the upper-right corner. Let's fill in the form and find out what each control does:
- Group name: Enter Our users.
- Users: Here, we can add users to the group we are creating. Our current installation has very few users, so finding the correct username with all users displayed is easy. ?Select monitoring_user and click on the button or just type the name in the box and select the correct user.?
- Frontend access: This option allows us to choose the authentication method for a specific group. It allows for a configuration where most users are authenticated against LDAP, but some users are authenticated against the internal user database. It also allows us to set no GUI access for some groups, which can then be used for users that only need to receive notifications. We'll leave this option as?System default.
If your Zabbix installation uses LDAP for user authentication, setting Frontend access to Internal for a user group will make all users in that group authenticate against the internal Zabbix password storage. It is not a failover option—internal authentication will always be used. This is useful if you want to provide access to users that are not in the LDAP directory, or create emergency accounts that you can pull out of a safe when LDAP goes down. Such an approach will not work with HTTP authentication, as it happens before Zabbix gets to decide anything about the authentication backend:
With the main settings covered, let's switch to the Permissions tab:
It also provides us with another valuable bit of information. have finally got the essential information together—in Zabbix, permissions can be set for user groups on host groups only.
Mark the checkbox next to Linux servers/SNMP group and click on the Select button.
We can now see that?SNMP devices?has been added to the Read-write?box. Next, click on the Read?box. This time, mark the checkbox next to the Linux servers entry, and then click on Add. You will see that Zabbix also adds the Linux servers/Test group?but with permissions set to?None.? This is because, when we created our Linux servers?host group, we had the option to select Apply permissions and tag filters to all subgroups, but we left that box unmarked. If we had marked that option, then all the subgroups from the Linux servers?group would have inherited the permissions from the Linux servers group.
The final form should look like this:
Let's get back to Browser 2. Navigate to Monitoring | Latest data. Click on Select next to the Host groups field. Great, both of the groups we selected when configuring the permissions are available. Mark the check-boxes next to them and click on Select. Then, click on Apply. Now, our new user can view data from all the hosts. But we also added write permissions to one group for this user, so what's up with the Configuration menu? Let's recall the user-creation process—wasn't there something about user types? Right, we were able to choose between three user types, and we chose Zabbix User, which, as we discussed, was not allowed to access configuration.
To continue exploring user permissions, we'll create another, more powerful user. In Browser 1, go to Administration | Users, and click on the Create user button. Fill in these values:
- Alias: Enter advanced_user.
- Name: Enter advanced.
- Surname: Enter user.
- Groups: Click on Select, mark the checkbox next to Zabbix administrators, and click on Select.
- Password: Enter a password in both fields. You can use the same password as for monitoring_user to make it easier to remember.
- Refresh: Enter 60s.
- URL (after login): Let's have this user view a different page right after logging in. The overview page might do—enter overview.php here.
Now, switch to the Permissions tab and select Zabbix Admin from the User type drop-down. This is will make quite a big difference, as we will soon see:
Let's use Browser 2 now. In the upper-right corner, click the logout icon, and then log in as advanced_user. This user will land on the overview page, and this time, we can see the Configuration section. That's because we set the user type to Zabbix Admin. Let's check out what we have available there—open Configuration | Hosts?and select all?from the Group selection box:
Suddenly, we notice that we have granted configuration access to the snmptraps host this way, which we consider an important host that should not be messed with and that neither of our two users should have access to anyway. How can we easily restrict access to this host while still keeping it in the SNMP devices group?
In Browser 1, navigate to Configuration | Host groups and click on Create host group. Enter the following details:
- Group name: Enter Linux servers/Important SNMP hosts
- Configuration | Hosts: Go to host snmptraps and in?the Group box, select Linux servers/Important SNMP Hosts
When done, click on Update.
Open Administration | User groups, click on Our users in the Name?column, and switch to the Permissions tab. In the group details, click on the ?Deny?box. Click select and select?Linux servers/Important SNMP Hosts,?and then click on the Update button: