Administrators are SFTPPlus accounts dedicated to accessing the Local Manager administration service. They cannot be used for file transfer operations.
In order to simplify configuration management for a large number of administrators, the administrator accounts are associated to a role.
This allows, for example, to easily disable access for all administrator accounts associated to a particular role by simply disabling the role instead of having to disable every account.
The options for administrators and roles can be modified as any other configuration option.
The roles represent a collection of permissions for Local Manager administrators that can be individually turned on and off.
Roles can also be associated to operating system groups. In this way, you can allow access for administrators defined in operating system groups, e.g. using a Domain Controller or other centralized identity management systems, just like you would for an application-level administrator.
A role can be shared between operating system groups and application-level administrators.
Note
The name role is used to avoid confusion with groups of regular accounts.
Adding a new role is done by creating a new section inside the configuration file. The name of the section should be prefixed with roles/ and followed by the role’s UUID.
The role’s UUID can be any unique string used to identify the role. Once defined, the UUID should not be changed.
For more information about UUIDs, please see the dedicated UUID documentation.
For example, to add a new role named SuperAdmins
[roles/a904e3a6-a59b-4bbf-8abd-edcae4d3774f]
name = SuperAdmins
enabled = Yes
description = Administrators having unrestricted access to Local Manager.
include_os_group = No
Note
Setting include_os_group to Yes will automatically allow access to all OS accounts that are members of the group with the same name as the one set for the role.
In this way you do not need to manually add the administrators in the configuration file.
Adding a new administrator is done by creating a new section inside the configuration file. The name of the section should be prefixed with administrators/ and followed by the administrator’s UUID.
The administrator’s UUID can be any unique string used to identify the administrator. Once defined, the UUID should not be changed.
For more information about UUIDs, please see the dedicated UUID documentation.
An administrator can be an application-level account defined for accessing the Local Manager or a local operating system account belonging to an operating system group associated to a role.
An administrator can be associated with a single role.
Warning
The server does not support authentication of operating system administrators that are used for multiple roles. In this case, the result is undefined.
For example, to add a new administrator named sa-admin
[administrators/804aab78-70c0-4e1d-8480-4979e169a0a2]
name = sa-admin
enabled = Yes
description = Administrator account for our super admin.
password = $5$rounds=1000$utwEAUxeFBXSF0Uf$klQTAMRygQfijPXMYZCddVug
role = 404aab78-70c0-4e1d-8480-4979e169a0a4
The following configuration options are available for roles:
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 2.1.0 |
| Values: |
|
| Description: | This option specifies whether or not to disable access for all administrators associated with this role. |
| Default value: | ‘’ |
|---|---|
| Optional: | No |
| From version: | 2.1.0 |
| Values: |
|
| Description: | Human-readable short string used to identify this role. By using the name configuration option, one can associate this role with an existing OS group, if the include_os_group is set to Yes. |
| Default value: | ‘’ |
|---|---|
| Optional: | Yes |
| From version: | 2.1.0 |
| Values: |
|
| Description: | Human-readable text that describes the purpose of this role. |
| Default value: | No |
|---|---|
| Optional: | Yes |
| From version: | 2.1.0 |
| Values: |
|
| Description: | When set to Yes, this role will automatically include all OS accounts that are members of the OS group with the same name. This option can be used for associating a group defined in the operating system with a role defined in the server’s configuration. When a role includes all accounts from the OS group with the same name, it is no longer required to manually define administrators in the configuration file. The Local Manager service will automatically authenticate local OS accounts from this role. Example: [roles/404aab78-70c0-4e1d-8480-4979e169a0a4]
name = Administrators
enabled = Yes
description = Administrators retrieved from the operating system.
include_os_group = Yes
|
The following configuration options are available for administrators.
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 2.1.0 |
| Values: |
|
| Description: | This option specifies whether or not to enable access for this administrator. |
| Default value: | ‘’ |
|---|---|
| Optional: | No |
| From version: | 2.1.0 |
| Values: |
|
| Description: | Human-readable short string used to identify this administrator. It also represents the login or username value for this administrator. |
| Default value: | ‘’ |
|---|---|
| Optional: | Yes |
| From version: | 2.1.0 |
| Values: | Any character string. |
| Description: | Human-readable text that identifies the person or entity to use this administrator account and/or describes the account’s purpose. Example: [administrators/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
description = Administrator from the SA team.
Contact: someone@email.tld
name = sa-operator
|
| Default value: | Disabled |
|---|---|
| Optional: | Yes |
| From version: | 2.1.0 |
| Values: |
|
| Description: | This option specifies the password used for validating the credentials for this administrator. It is stored encrypted using the cryptographic hash function SHA-256. To get the hashed password please check how to generate encrypted passwords using admin-commands. When the password is set to Disabled or left blank, the administrator will not be able to authenticate, even if the enabled option is set to yes. |
| Default value: | DEFAULT-ROLE |
|---|---|
| Optional: | No |
| From version: | 2.1.0 |
| Values: |
|
| Description: | Human-readable short string used to identify this role. |