Using CERMM
Users and two-factor
Everyone signed in sees everything. Privileges are about changing things.
Privileges
| Privilege | Lets you |
|---|---|
| Run commands | Scripts, software installs, the catalog, the terminal, patches, playbooks |
| Manage devices | Add and remove devices, agent updates, thresholds, tags and groups, tickets, assets |
| Edit docs | Write, edit and delete docs |
| Passwords | Open the vault, add and change entries, give others access |
| Audit log | See all activity |
| Manage users | Add people, set privileges, reset passwords and two-factor, security rules |
Roles are names for sets of them: Admin (everything), Technician (run commands, manage devices, edit docs, passwords) and Read-only (none). Any other mix is Custom.
The server checks every change against these. The app hides what you can't use: a read-only person sees a device's job history but no Run controls. Changes to privileges and suspensions apply at once.
Adding someone
Settings → Users (with Manage users). Adding a person makes a one-time link, good for 7 days, where they choose their own password. Only its hash is kept. Send it to them however you like.
Looking after people
- Reset password: a new link, and they're signed out. Their two-factor stays and is asked for.
- Reset two-factor: for a lost phone.
- Suspend: they can't sign in, and get no notifications.
- Delete: they're gone; their actions stay in the audit log under their username.
Someone who may manage users must always remain.
Two-factor sign-in
Each person's own, in Settings → Security: a QR code for any authenticator app (TOTP), and 10 one-time recovery codes. A code is good once.
Two-factor for everyone is a switch in Settings → Users. You need it yourself before you can turn it on. Someone without it is then shown only the setup step until they've done it.
Sessions
Settings → Security lists where you're signed in, with Sign out for each and Sign out everywhere else. Changing your password ends the others. A sign-in lasts 30 days, or ends after two weeks unused.
Locked out? See Locked out.