1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
# Copyright (C) 2004 Stanislav Sinyagin
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
# Stanislav Sinyagin <ssinyagin@yahoo.com>
#
#
=head1 NAME
acledit - Manage Torrus access control lists (ACLs).
=head1 SYNOPSIS
B<torrus acledit> [I<options...>]
=head1 DESCRIPTION
This command manages the Torrus access control lists. Each user is
identified by user ID, and has a set of attributes. Currently
supported attributes are C<cn> (common name) and C<userPasswordMD5>
(MD5 digest of the user's password).
Each user belongs to one or several groups. Each group has its own
set of privileges. A privilege is identified by privilege name and
object name. Currently only one privilege name is supported:
C<DisplayTree>, and the object name is the name of the tree that
this group is allowed to browse.
User authorization in the web interface is controlled by the
C<$Torrus::CGI::authorizeUsers> variable in F<torrus-siteconfig.pl>.
=head1 GROUP MANAGEMENT OPTIONS
=over 4
=item B<--addgroup>=I<GROUP>
Creates a new group with the given name.
=item B<--delgroup>=I<GROUP>
Deletes the group with the given name.
=item B<--modgroup>=I<GROUP>
Modifies the given group.
=item B<--permit>=I<PRIVILEGE>
Grants privilege to group(s). Currently supported privileges are:
C<DisplayTree> for displaying a datasource tree, and C<DisplayAdmInfo>
for displaying the administrative information (all significant
parameters for a given datasource leaf).
=item B<--deny>=I<PRIVILEGE>
Revokes group(s) privilege.
=item B<--for>=I<OBJECT>
Object for which privileges are granted or revoked. Currently it must be
the name of the tree for which the C<DisplayTree> and C<DisplayAdmInfo>
privilegs are granted or revoked. The asterisk (*) instead of the object
name assigns the privilege for all objects.
=back
=head1 USER MANAGEMENT OPTIONS
=over 4
=item B<--adduser>=I<UID>
Creates a new user with the given user ID.
=item B<--addhost>=I<HOST>
Creates a new user for host-based authentication. I<HOST> should be an
IPv4 or IPv6 address of the HTTP client. The new username is the address
with all non-alphanumeric characters replaced with underscores.
Host password is changed by <--hostpassword> option.
=item B<--deluser>=I<UID>
Deletes user with the given user ID.
=item B<--moduser>=I<UID>
Modifies the user attributes for the given user ID.
=item B<--addtogroup>=I<GROUP>
Adds user to the given group.
=item B<--delfromgroup>=I<GROUP>
Deletes user from the given group.
=item B<--password>=I<PASSWORD>
Sets user's password.
=item B<--hostpassword>=I<PASSWORD>
Sets the password for host-based authentication. The HTTP client should
add C<hostauth> parameter with the password as a value.
=item B<--cn>=I<NAME>
Sets user's common name.
=item B<--showuser>=I<UID>
Displays information for a given user.
=back
=head1 GENERAL OPTIONS
=over 4
=item B<--export>=I<FILE>
Exports ACL configuration to a given file.
=item B<--template>=I<FILE>
Uses the given template file when exporting. Default value is F<aclexport.xml>.
=item B<--import>=I<FILE>
Imports ACL configuration from the given file.
=item B<--clear>
Deletes all user and privileges configuration.
=item B<--list>
Lists all users and groups they belong to.
=item B<--debug>
Sets the log level to debug.
=item B<--verbose>
Sets the log level to info.
=item B<--help>
Displays a help message.
=back
=head1 EXAMPLES
torrus acledit --addgroup=staff --permit=DisplayTree \
--for=main --for=thecustomer
torrus acledit --adduser=jsmith --password=mysecretpassword \
--cn="John Smith" --addtogroup=staff
torrus acledit --addgroup=admin --permit=DisplayTree --for='*'
This example creates a group I<staff> and gives all its members the permission
to browse the datasource trees I<main> and I<thecustomer>. The next command
creates a user I<jsmith> and addts it to this group. The user name will
be displayed as I<John Smith>, and it will be let in with the given
password. The third command creates a group I<admin> which is allowed
o browse all existing trees.
=head1 FILES
=over 4
=item F<@siteconfdir@/torrus-siteconfig.pl>
Torrus site configuration script.
=item F<@tmpldir@/aclexport.xml>
Default template for the exports of ACL configuration.
=back
=head1 SEE ALSO
L<torrus(@mansec_usercmd@)>
=head1 NOTES
See more documentation at Torrus home page: http://torrus.org
=head1 AUTHOR
Stanislav Sinyagin E<lt>ssinyagin@yahoo.comE<gt>
|
