Most NetVisualyzer tools require authorization to use them. Authorization takes several different forms; in some cases you must be superuser, and in other cases authorization files such as /usr/etc/rpc.snoopd.auth and /usr/etc/snmpd.auth must contain appropriate entries. This appendix lists the authorization required to use each tool and describes the syntax of /usr/etc/rpc.snoopd.auth (/usr/etc/snmpd.auth is described in the snmpd(1M) manual page in Appendix F, “NetVisualyzer Manual Pages”).
Table B-1 lists each NetVisualyzer tool and the authorization required to use it. In cases where the authorization required depends upon the command line options given or which feature of the tool is used, each type of line options given or which feature of the tool is used, each type of authorization required is listed.
Table B-1. Tool Authorization Summary
Tool | Option | Authorization |
|---|---|---|
Analyzer | Snoop on local workstation on default interface | User must be superuser or be authorized in /usr/etc/rpc.snoopd.auth for netsnoop service. |
| –i interface (snoop on interface) or interface specified in Interface entry field on Capture control panel | If RPC snooping is used, user must be authorized in /usr/etc/rpc.snoopd.auth for netsnoop service on the Data Station used for snooping. If direct snooping is used, user must be superuser. See Table 8-1 for more information; it applies to Analyzer as well as to NetSnoop.
|
| –i packet_file (snoop from file) or packet_file specified in Snoop file entry field on Capture control panel | No special authorization is required. |
Browser | any | The host running Browser must be authorized in /usr/etc/snmpd.auth on Silicon Graphics nodes browsed; user must specify appropriate community string for all types of nodes. |
NetAccount | any | |
NetCollect | any | User must be authorized in /usr/etc/rpc.snoopd.auth for netlook service. |
NetFilters | any | |
NetGraph | any (snoop on any interface or from a file) | User must be authorized in /usr/etc/rpc.snoopd.auth for histogram service on the Data Station used for snooping. |
NetLook | any (snoop on any interface or from a file) | User must be authorized in /usr/etc/rpc.snoopd.auth for addrlist service on each Data Station used for snooping. |
| Trace Route Action | User must invoke NetLook as root if the traceRouteCommand resource is set to traceroute and traceroute is not setuid; requirements above also apply. |
NetPack | any | |
NetSnoop | –L | |
| Snoop on local workstation on default interface | User must be superuser. |
| –i interface (snoop on interface) | If RPC snooping is used, user must be authorized in /usr/etc/rpc.snoopd.auth for netsnoop service on the Data Station used for snooping. If direct snooping is used, user must be superuser. See Table 8-1 for more information. |
| -i packet_file (snoop from file) | No special authorization is required. |
NetTop | any (snoop on any interface or from a file) | User must be authorized in /usr/etc/rpc.snoopd.auth for addrlist and histogram services on the Data Station used for snooping. |
On each Data Station, the file /usr/etc/rpc.snoopd.auth contains authorization information that specifies which users using which hosts are authorized for snoopd(1M) services. You must be superuser (root) to read or write /usr/etc/rpc.snoopd.auth. For security reasons, the owner and permissions of this file should not be changed.
A simple authorization line in /usr/etc/rpc.snoopd.auth has the form:
accept localhost:user |
This line authorizes the user user to use all snoopd services on this Data Station when he or she starts NetVisualyzer tools from this Data Station. user can be a login name, a numerical user id, or an asterisk (*), which stands for all users. To use localhost in /usr/etc/rpc.snoopd.auth, localhost must be defined in /etc/hosts.
Another simple authorization line is:
accept * |
This line authorizes all users on all hosts to use all services on this Data Station. The asterisk on this line is a wild card that stands for all hosts. Specifying user is optional; if no user is given, the authorization line applies to all users.
You do not need to have a separate line for each user; you can replace user with a comma-separated list of users:
accept localhost:belle,ariel,snowwhite |
To authorize users to snoop on this Data Station while they use NetVisualyzer tools on another workstation, use a line of this form:
accept host:user |
host can be a workstation name or Internet address. It can be replaced with an asterisk (*), to indicate that user has authorization from any host, or it can be a comma-separated list of workstation names or Internet addresses.
To specify that a user must be a member of a specific group, use the form:
accept host:user.group |
group can be a group name or group id. Examples of this form and several variations include:
| accept reddog:root.net |
| |
| accept *:root.* |
| |
| accept wookie:*.user,engr |
| |
| accept *:joe.engr+net |
|
It is possible to restrict access to just some of the snoopd services. Authorization lines that restrict services have the basic form:
accept host:user.group/service |
These are the possible values of service and the tools that require them:
| netlook | ||
| netcollect | ||
| histogram | ||
| netgraph | ||
| netsnoop | ||
| analyzer | ||
| addrlist |
A comma-separated list of services can be used to authorize several services. Examples are:
| accept yeti:joe/netlook,netgraph |
| |
| accept */netlook |
|
Authorization lines can prohibit access to snoopd services. These lines begin with reject, but otherwise have the same basic form as lines that begin with accept:
reject host:user.group/service |
Some examples of lines that prohibit the use of the Data Station are:
| reject aztec,maya,inca |
| |
| reject *:guest |
| |
| reject */addrlist |
|
Finally, several accept or reject lines can be combined on one line by separating the specifications with white space. For example:
| accept curly:* moe:*.net larry/netgraph |
|
See the snoopd(1M) manual page in Appendix F for other examples of entries in the /usr/etc/rpc.snoopd.auth file. For information on the /etc/passwd file, see passwd(1M).