Authorization for CS Users
Chapter 9
Authorization
335
for administrators who are only authorized to view logs. You could name the group
LogAdmins
and modify the ACLs relevant to logs to allow read or modify access to this
group. If you did not add this group to any other ACLs, members of this group would only
have access to the logs.
How ACIs are Formed
You change the access for a user, group, or IP address by editing the ACI entries in the
ACLs. You can change who is allowed or denied access by adding a user, group, or IP
address to the ACIs in an ACL entry. In the ACL interface, each ACI is shown on a line of
its own. In this interface window, the ACI has the following syntax:
allow|deny (operator) user|group|IP=”name”
For example, the following is an ACI that allows Administrators to perform the read
operation for the tasks associated with this ACL:
allow (read) group=”Administrators”
An ACI can have more than one operator. The operators are separated with a comma with
no space on either side. For example:
allow (read,modify) group=”Administrators”
An ACI can have more than one group, user, or IP address by separating them with two pipe
symbols (||) with a space on either side. For example:
allow (read) group=”Administrators” || group=”Auditors”
In the CS console interface, you create or modify ACIs in an editor that allows you to do
this in a graphical environment. You choose from allow or deny in the Allow and Deny
field, then you choose one of the operations that are possible for this ACL in the Operations
field, and then you list those groups, users, or IP addresses that are being granted or denied
this access in the Syntax field.
Allow and Deny
An ACI can either allow an operation for the specified group, user ID, or IP address, or
deny the operation for the specified group, user ID, or IP address.
Generally, you do not have to create ACIs to deny access. If a group, user ID, or IP address
is not allowed access to an operation—that is, there are no allow ACIs that when evaluated,
would include the user ID, group, or IP address—the group, user ID, or IP address is denied
access.
Summary of Contents for CERTIFICATE 7.1 ADMINISTRATOR
Page 1: ...Administrator s Guide Red Hat Certificate System Version7 1 September 2005 ...
Page 22: ...22 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 128: ...Cloning a CA 128 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 368: ...ACL Reference 368 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 460: ...Constraints Reference 460 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 592: ...CRL Extension Reference 592 Red Hat Certificate System Administrator s Guide September 2005 ...
