A user/contact with RestAPI access to submit results for passive checks.
-
Centreon administrator/operator.
-
We are using passive checks for which results are sent to Centreon over RestAPI v2. A custom script which communicates with Centreon over RestAPI is using a user account which must have admin rights and which must also be allowed reach Centreon Front-end. When you deselect “Reach Centreon Front-end” option the user will not be permitted to login via RestAPI. Our script is running on remote machines which don’t belong to us. It is not very secure to leave inside our custom script the username and password which can be used to access Centreon front-end. But at the moment we have no choice (I can encode the password while using Powershell for our script but any local admin with some system knowledge can decode it). At least in one of the previous version we could deselect “Reach Centreon Front-end” option but it stopped working.
-
A user can be configured in a way it can submit check results for passive checks over RestAPI v2 but it doesn’t have to be an admin and can be configured to not be allowed to “Reach Centreon Front-end”. So the username and password can be stored in a script and it is uselesss when trying to connect with Centreon Web GUI.
Such a user can be assigned a generated token only for RestAPI communication so the token can be stored within our custom script without revealing the password for the user.
Also using ACLs such a user could be configured to be allowed to submit check results only for host objects it has access granted in Resource Access.
