NAME

       xymon-webaccess - Web-based access controls in Xymon

DESCRIPTION

       Xymon  does  not provide any built-in authentication (login) mechanism.  Instead, it relies on the access
       controls available in your web server, e.g. the Apache mod_auth modules.

       This provides a simple way of controlling access to the physical directories that make up the  pages  and
       subpages  with  the  hosts  defined  in  your Xymon hosts.cfg(5) setup - you can use the Apache "require"
       setting to allow or deny access to information on any page, usually through the use of a  "Require  group
       ..." setting. The group name then refers to one or more groups in an Apache AuthGroupFile file.

       However, this does not work for the Xymon CGI programs since they are used to fetch information about all
       hosts in Xymon, but there is only a single directory holding all of the  CGI's.  So  here  you  can  only
       require that the user is logged-in (the Apache "Require valid-user" directive). A user with a login can -
       if he knows the hostname - manipulate the request sent to the webserver and fetch information  about  any
       status by use of the Xymon CGI programs, even though he cannot see the overview webpages.

       To  alleviate  this  situation,  the  following  Xymon  CGI's support a "--access=FILENAME" option, where
       FILENAME is an Apache compatible group-definitions file:
       svcstatus.cgi(1)
       acknowledge.cgi(1)
       enadis.cgi(1)
       appfeed.cgi(1)

       When invoked with this option the CGI will read the Apache group-definitions file,  and  assume  that  an
       Apache  group  maps to a Xymon page, and then - based on the logged-in userid - determine which pages and
       hosts the user is allowed access to.  Only information about those hosts will be made  available  by  the
       CGI tool.

       Members of the group root has access to all hosts.

       Access  will  also  be  granted,  if the user is a member of a group with the same name as the host being
       requested, or as the statuscolumn being requested.

SEE ALSO

       The     Apache     "Authentication,     Authorization     and     Access     Control"      documentation,
       http://httpd.apache.org/docs/2.2/howto/auth.html