mirror of
https://github.com/Cacti/documentation.git
synced 2026-10-23 03:26:44 +09:00
Thomas Vincent
57b8088e13
* docs: comprehensive audit, Spine poller overhaul, and technical refactor - Overhaul Spine documentation (Spine.md) with complete end-to-end guide: architecture, prerequisites for modern distros (EL8/9 CRB, Ubuntu 22/24, Debian 11/12, FreeBSD), SUID root permissions, secure spine.conf setup (0640), Web UI configuration (Paths, Poller type, Data Collectors tuning), MySQL max_connections sizing, and troubleshooting. - Fix broken links and anchors (Hardening, SNMP data queries, Hook API references). - Fix broken image reference in Sites.md (add-site.JPG -> add-site.png). - Fix syntax errors in documentation PHP code blocks, including invalid parenthesization, missing SQL execute quotes, and malformed comments in FAQ. - Fix DevOps installation commands: use config.php.dist, correct systemctl service names for MySQL/MariaDB/PHP-FPM, remove nonexistent php-json, add missing composer install, and correct Debian/Ubuntu systemd environment path. - Correct grammatical errors, repeated words, and typos across all markdown documents. - Remove obsolete unreferenced duplicate installation guides. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: correct reviewed examples and guidance Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: correct guidance that disagrees with the Cacti source Verified each claim against include/global_arrays.php, lib/auth.php, lib/functions.php, host_templates.php and the Spine config parser. The notable ones: api_plugin_safe_exec() does not exist on either branch, Spine reads DB_Pass rather than DB_Password, and the CDEF special data source table was missing five entries and renamed four others. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: wrap Spine prose and fence the connection sizing formula The formula's bare asterisks rendered as emphasis, dropping the multiplication signs. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * chore: refresh copyright year in scripts and issue templates Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
3.1 KiB
3.1 KiB
Authentication
Overview
Cacti provides four Authentication methods. Combined with the Apache and nginx authentication modules, Cacti can support most of the Authentication methods in common use. Those Authentication methods are:
- Built-in Authentication - With this method, Cacti stores both the user
account and its password on the Cacti server. The password is hashed with
PHP's
password_hash()using the default algorithm, and it is rehashed on login whenever that default algorithm or its cost changes. This method also supports the local complexity, history and expiry policies described in Local Authentication. - Web Basic Authentication - With this method, the web server itself controls the Authentication. Cacti then accepts whatever the web server authenticated, so the web server can front Cacti with SAML 2.0, Kerberos, NIS, LDAP, a local password file, TACACS+ or another scheme.
- LDAP Authentication - Cacti supports direct communication with LDAP and Active Directory servers as well. When using this method, Cacti can limit what User Group may access Cacti based upon more detailed settings.
- Multiple LDAP/AD Domains - When you have multiple security levels and/or LDAP and AD Domains that you wish to support, for example maybe you have Admins, Power Users, and General Users groups defined and you wish to restrict who can log in as whom, this Authentication method lets you set up that type of security system.
For most of these Authentication Methods, there are some common settings
shown in the image below.
Those options include:
- Authentication Method - One of the options below.
- Support Authentication Cookies - Offers a
Keep me signed incheckbox on the login page. The authentication cookie keeps the user signed in on that browser and expires after 90 days without use. The client must use HTTPS for the cookie to be issued. - Primary Admin - This is the Primary Cacti Admin account. This user account receives Cacti administrative notifications, such as when the Cacti system is experiencing issues.
- Guest User - If you select a Guest User, people within an organization will be able to access certain Cacti pages without first authenticating. This setting is good for pages like the Graph Page where you may wish to embed live Cacti Graphs in other corporate websites.
- User Template - When creating new accounts, whether LDAP, Web Basic, or new Cacti local accounts, Cacti takes the user's default authorization from this Template User account. For some Cacti Authentication Methods you can have more than one Template User, for example Multiple LDAP/AD Domains.
In the sections below, we will go over these various Authentication Methods and their settings.
Copyright (c) 2004-2026 The Cacti Group