HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   General (http://www.howtoforge.com/forums/forumdisplay.php?f=25)
-   -   ISPConfig 3 - Client permissions (http://www.howtoforge.com/forums/showthread.php?t=46540)

jmontoya 14th June 2010 14:18

ISPConfig 3 - Client permissions
 
There is a way to restrict client permissions? I have the latest version from SVN, and when I create a client and then login with his credentials I can create new sites (domains), DNS Zones, etc...

jmontoya 14th June 2010 14:31

I'm answering my self:

In fact we can change permissions modifying in the database the field "modules" in the "sys_user" table.

But... there are not a interface to set permissions?

Yes, there is an interface here:

Log on as an Admin -> System tab ->Edit User (Left menu under the "CP User" label) -> Select a user

And then we will have a UI to change the modules BUT there is a message saying:

WARNING: Do not edit or modify any user settings here. Use the Client- and Reseller settings in the Client module instead. Modifying or changing Users or groups here may cause data loss!

So I go in the "Client and reseller" settings but I don't find the UI to change access to modules. The question is where I can safely change the user permissions?

Toucan 14th June 2010 19:33

It's fine to add or remove client's modules there.

It's not good though to add or remove clients in that fasion.

vogelor 14th June 2010 20:12

There are two types of limitations
1) hide a complete module for a client (if he can't see the module dns, he can't change anything) -> this is done under system -> edit user (the warning means not to change the username or the password)
2) set the number of a limitation -> this is done under User->edit client templates (here you can set the limitations and give them a name) and under client -> edit clients (here you can select a master template for limitation of the user. select a master-template ans click at save. if you come back, the restrictions of the master-template are submitted to the client. you can also edit additional templates (set all to 0 and only e-Mail to 5 and name it "+5 E-Mails". if you then add the additional tempalte to the master the number of email = limitation master-template + limitation additional template). so you can create a master called "web light", "web std" "web business" and if you neet "web light + 10 E-Mail" then select the master "web light" and add TWO times +5 E-Mails

Hope, this helps

Olli

CryoGenID 20th June 2010 13:01

Hello,

I have just found this topic and have also a few questions regarding the user-permissions:
We do not want our users to be able to create new domains, but they should be able to change settings for their already registered domains.

We can at the moment either block their access to the "site"-Module completely, or they can add new domains, see all IP's the Server has, etc.
And even change the Harddisk-Quota, etc. :eek:

How can we limit the access-permissions?

That is the same with the email-Addresses.. They should only be able to create eMail-Addresses for their own domains and not be able to create new domains...

Thanks a lot and best regards,

Christian

vogelor 20th June 2010 16:58

In the svn-version there is a new module called "domain". if you activate this module, your customer can only add a domain, you have added for them.

Means, if you said "d1.com" and "d2.com" are their domains, they can add a e-Mail-Domain, but only "d1.com" or "d2.com" - no more.

but! this is only experimental and only in the svn.

DO NOT USE SVN IN PRODUCTION ENVIRONMENTS!!!

CryoGenID 20th June 2010 17:25

Thanks a lot for your quick reply :-)

I will then try to find out how to check out the svn-version...

Do you have an ETA for this module?
Will that module also block the user from changing quota-settings etc. for his domains?

Thanks and best regards,

Christian

till 20th June 2010 17:38

Quote:

Do you have an ETA for this module?
No.

Quote:

Will that module also block the user from changing quota-settings etc. for his domains?
No, as thats already the case in the current versions. Just create the site as admin, and the user cant chnage these settings. If you let users create sites themself, they are bound to the limits in their client settings, so they can not exceed their limits in that way too.

CryoGenID 20th June 2010 17:49

Till,

thanks a lot for your reply!

I have just tried it out:
I can change the settings for a domain (as DomainOwner), but as soon as I click "Save", I get no error at all, my changes are simply not saved...
Shouldn't the SelectBoxes and TextAreas be "disabled" if I cannot change them anyway?

Regarding the permissions:
I can set certain rights for the client (e.g. PHP-Settings, Amount of DBs, etc.) but how are those related to a domain?
Example:
A customer has two domains, one is the expensive hosting-plan which includes PHP and has 5 DBs, the other one is cheap and just has 5 MB File-Hosting, no scripting languages at all.
How would I set the client up, so that he can, for example switch PHP ON/OFF for the expensive domain and cannot change anything regarding scripting for the other domain?

Don't get my wrong, ISPConfig so far seems great, we just want to know how we can get our current settings/workflows done with it ;-)

Thanks and best regards,

Christian

till 20th June 2010 18:45

In ISPConfig 3 you assign the limits to the client itself and not to a website. It does not make and different from a resource standpoint if a db is assigned to site a or b. Thats what the majority of hosting providers that use ispconfig wanted.


All times are GMT +2. The time now is 02:12.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.