Foglight 6.3.0 - Security and Compliance Guide

Service accounts

Foglight® manages login credentials for the following service and user accounts:

Agent credentials

When installing Foglight® cartridge agents it is typically necessary to enter credentials for the user accounts that are on the monitored resources, including the host and database. These credentials are entered through the agent configuration properties via the Foglight Administration Console and give an agent access to applications or operating systems on the monitored hosts.

The Management Server includes a central credential service that manages cartridge agent credentials. A lockbox contains a set of credentials and keys for their encryption and decryption. Releasing a lockbox to a credential client enables the client to release the credentials to the agent instances managed by that client, thereby granting the agent instances access to the monitored system. For more information, see Controlling remote system access with credentials.

Each Foglight cartridge may mark specific properties (for example, user names and passwords) of its agents as being sensitive. Such properties are given additional protection as described later in this document.

Foglight users and groups

There are two types of users in Foglight: internal and external users. Internal users are created using the Foglight® Administration Console. External users are mapped from one of the LDAP-compatible directory services supported by Foglight. All Foglight users are authenticated upon login, based on their user names and passwords.

Foglight includes one default internal user (foglight) with administrative access, and four default internal groups (Cartridge Developers, Foglight Administrators, Foglight Operators, and Foglight Security Administrators), none of which can be deleted.

Role-based access control

Foglight® security model is based on a role-based access control system (RBAC).

Roles dictate the actions that a user can perform. There are two types of roles in Foglight: default roles (called built-in roles), and custom roles (called internal roles).

Foglight defines a configuration item as an item that is created and/or managed in the Administration Console, such as a rule, registry variable, derived metric, or schedule. Access to individual configuration items can be restricted to specific users or roles. In addition, the level of access that each user or role has to that configuration item can be controlled through permissions.

A permission represents a set of actions that can be performed with regard to that configuration item.

Users who have the Foglight Security Administrator role can use the Foglight Administration dashboard to manage users, groups, roles, permissions, and configuration items.

The Groups view of the User Management dashboard contains a table that lists all of the groups that have been created in Foglight or imported from an LDAP-compatible directory service, as well as the users and the roles that have been assigned to them.