NetVault 13.0.3 - Administration Guide for Managed Service Providers

Table 115. Predefined Presets
Privilege	Administrator	Tenant administrator	Tenant user
Clients — Add/remove clients	X	X
Clients — Add/remove virtual/ clustered clients	X	X
Clients — Administer client groups	X	X
Clients — Configure client	X	X
Clients — Get client proper-ties	X	X	X
Clients — Set firewall relationship	X	X	X
Device — Add or Update Snapshot Array	X	X
Devices — Add libraries	X
Devices — Add Random Access Store	X
Devices — Add simple drives	X
Devices — Clean drives	X
Devices — Manage devices	X
Devices - Manage Array Snapshot	X	X	X
Devices — Open and close entry/exit ports	X
Devices — Open and close library doors	X
Devices — Perform device checks	X
Devices — Reconfigure devices	X
Devices — Remove devices	X
Devices — Set drive cleaning properties	X
Devices — Update Random Access Store	X
Jobs — Abort jobs	X	X	X
Jobs — Acknowledge policy errors	X	X	X
Jobs — Administer back-up/restore sets	X	X	X
Jobs — Administer policies	X	X
Jobs — Delete job	X	X	X
Jobs — Delete scheduled phase	X	X	X
Jobs — Hold job	X	X	X
Jobs — Jobs owned by this user may run	X	X	X
Jobs — Quiesce policy	X	X
Jobs — Restart job	X	X	X
Jobs — Resume job	X	X	X
Jobs — Run predefined jobs instantly	X	X	X
Jobs — Stop Job	X	X	X
Jobs — Submit/update backup jobs	X	X	X
Jobs — Submit/update re-store jobs	X	X	X
Jobs — View backup jobs	X	X	X
Jobs — View back-up/restore sets	X	X	X
Jobs — View policies	X	X	X
Jobs — View restore jobs	X	X	X
Media — Blank ANSI media	X
Media — Blank bad media	X
Media — Blank media	X
Media — Blank non-NetVault media	X
Media — Export media	X
Media — Get media or device item status	X
Media — Import media	X
Media — List media	X	X	X
Media — Load/unload media from drives	X
Media — Manage media requests	X
Media — Mark media for re-use	X
Media — Modify backup expiry data	X	X	X
Media — Remove media	X
Media — Scan foreign media	X
Media — View and diagnose media requests	X
Media — View backup expiry data	X	X	X
Media — View media properties	X
Media — Write media labels	X
NetVault Appliance - Adjust System Configuration	X
NetVault Appliance - Create Storage Containers	X
NetVault Appliance - Delete Storage Containers	X
Reports — Modify/edit report Jobs and components	X	X	X
Reports — View and run reports	X	X	X
Server — Manage Server Settings	X
Server — View events	X	X	X
Server — View logs	X	X	X
Services — Administer and restart	X
Storage Tier — Administer storage tier	X
Storage Tier — List storage tier	X	X	X
System — Change global notification profile	X
System — Dump log entries	X	X	X
System — Install/remove software packages	X	X
System — Install license	X	X
System — Manage dashboards	X	X	X
System — Manage Operator Messages	X	X	X
System — Permitted to use CLI tools	X
System — Purge log entries	X
System — View dashboards	X	X	X
Users — Administer user accounts	X	X
Users — Reset password for user	X

Integrating Active Directory with NetVault

NetVault installed on a Windows or Linux machine can communicate with Microsoft Active Directory (AD). Additionally, NetVault installed on a Linux machine can communicate with OpenLDAP Directory Services. Integrating AD with NetVault enables role-based access control in NetVault. It lets users log in to NetVault using their AD credentials. It also lets AD users manage NetVault users.


	NOTE: NetVault Server supports Secure Light Directory Access Protocol (LDAPS) protocol for both Microsoft Active Directory (AD) and OpenLDAP Directory.


	IMPORTANT: During Active Directory integration with NetVault, the Active Directory service must always be available. Additionally, the NetVault Server should be a member of the domain.

Adding an AD group to NetVault and specifying privileges, levels of access, and notifications for the group ensures that members of the group have the corresponding access from the first time that they log on.

•

Considerations for Linux-based NetVault

•

Managing AD users

•

Managing AD groups

Considerations for Linux-based NetVault

Before you integrate Active Directory (AD) with a Linux-based installation of NetVault, consider the following conditions and prerequisites:

•

To let the Linux server communicate with AD, integrate NetVault with the domain controller using Samba Winbind or System Security Services Daemon (SSSD).

•

Host name of the Linux machine should be set to its FQDN. (For example, mymachine.mydomain.com)

•

Enable the use of fully qualified domain names on the Linux machine on which NetVault is installed. Short names are not permitted.

•

Samba Winbind: Under the [global] section, smb.conf must have the following entry:

winbind use default domain = no

•

SSSD: under the [domain/<domain name>] section, sssd.conf must have the following entry:

use_fully_qualified_names = True

•

On the Linux machine where NetVault is installed, to retrieve all domain controller groups, enable enumeration of group databases.

•

Samba Winbind: Under the [global] section, smb.conf must have the following entry:

winbind enum groups = yes

•

SSSD: Under the [domain/<domain name>], to retrieve domain controller groups and to fetch groups from child and trusted domains, respectively, the sssd.conf must have the following entries:

enumerate = True

subdomain_enumerate = all

•

While logging in or adding a domain user, using the DNS suffix with the domain name is recommended; for example, domain.local\user or username@dns.local.

•

When logging in using an Active Directory (AD) user on RHEL 8.x, add the following parameters, and then restart the SSSD service:

•

In the /etc/pam.d/passwd file, add:

auth include system-auth

account include system-auth

•

In the /etc/sssd/sssd.conf file, add: