topic Re: Create DFM Monitoring Account in Active IQ Unified Manager Discussions

Create DFM Monitoring Account

MSANDONASSGA — Wed, 09 Mar 2016 14:15:10 GMT

Hello,

i'm not getting anywhere with netapp support on this topic and was hoping somebody in the community might be able to help.

We currently use ROOT to monitor our systems in DFM. I want to use an existing domain service account to do this function but I don't want to elevate it to ADMIN on the filers which is Netapp's first suggestion.

Has anyone created a custom role on their filers that grants only the NECESSARY capabilities to an account so that it can perform DFM monitoring but is not an admin or has login capabilities? If so, can you let me know the capabiliities you granted the role?

thank you.

Matt

Re: Create DFM Monitoring Account

JGPSHNTAP — Wed, 09 Mar 2016 14:54:15 GMT

It needs access to just about every API, so creating a role would be futile and a waste of time and effort.

Just create a domain service account and add it. That's common practice.

If you want to break out the roles, it will take you a really long time and you will just get frustraded.

I manage 7-mode controllers that number in the 3 digits this way.

Just ensure service account password is under lock and key

Re: Create DFM Monitoring Account

MSANDONASSGA — Wed, 09 Mar 2016 16:47:51 GMT

Thanks for the input. Everything I've been reading bears this out. We'll go this way. thanks.

Matt

Re: Create DFM Monitoring Account

Baiju — Mon, 19 Nov 2018 08:59:09 GMT

Hi,

If we go with AD service account, how can we make sure that no one can login to filer using same account via ssh. Thanks in advance.