Skip to main content
Version: 4.2.0 🚧

Minimum Permissions

Introduction​

Below are the minimum permissions for VAST and Qumulo for Data Security.

Minimum Permissions​

Minimum Permissions for VAST - Data Security​

Below is a table summarizing the minimum VAST permissions required to perform DR/DS operations (e.g., creating security guard shares, snapshots, and managing S3 policies).

  1. In the VAST Web UI, navigate to Administrators > Roles:

    • Create a new role or edit an existing one.
    • Assign the required permissions (Logical, Security, Hardware, Support) as needed.

  2. Next, go to Administrators > Managers:

    • Select or create the manager account.
    • Assign the role created/updated in the previous step.

  3. Use this manager account when adding your VAST cluster to Eyeglass.

RealmNeeded PermissionsReason
LogicalCreate, View, Edit, DeleteRequired to create “security guard” shares or snapshots
SecurityCreate, View, Edit, DeleteRequired to manage S3 policies (replication) and generate/remove access keys.
HardwareView (Read)Required to collect LDAP, NIS, Active Directory, and S3 policy configuration details.
SupportView (Read)Required to collect license inventory from infrastructure.

alt text

All of the above permissions are needed for both Disaster Recovery (DR) and Data Security (DS).

Minimum Permissions for Qumulo - Data Security​

SSH into the Qumulo cluster using the admin username and password. Run the following commands:

qq auth_create_role --role Eyeglass-Admin --description "Eyeglass-Admin role"
qq auth_add_user --name eyeglassuser --password Gosuperna!
qq auth_assign_role --role Eyeglass-Admin --trustee eyeglassuser

Run the following commands to establish minimum privileges for Data Security:

qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_AD_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_AD_USE
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_LOCAL_GROUP_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_LOCAL_USER_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_NETWORK_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_NFS_EXPORT_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_QUOTA_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SMB_SHARE_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SMB_SHARE_WRITE
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SNAPSHOT_POLICY_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SNAPSHOT_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SNAPSHOT_WRITE
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SMB_SESSION_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_SMB_SESSION_WRITE
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_TENANT_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_S3_BUCKETS_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_REPLICATION_SOURCE_READ
qq auth_modify_role --role Eyeglass-Admin --grant PRIVILEGE_FS_ATTRIBUTES_READ