Thomas Vincent
cb29d10426
* docs: update stale PHP/MySQL/MariaDB version requirements - Requirements.md: PHP 5.4 -> 8.1 (matches 1.2.31+ requirement note) - Requirements.md: MySQL 5.6 -> 5.7, MariaDB 5.5 -> 10.2 (current minimums) - Requirements.md: MySQL section header updated to >= 5.7 / 10.2 - Requirements.md, Install-Under-CentOS_LAMP.md, Install-Under-CentOS_LEMP.md, Installing-Under-Windows.md: comment out innodb_file_format and innodb_large_prefix (removed in MySQL 8.0 / MariaDB 10.3+) Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: upgrade http:// links to https:// and fix dead wiki URLs - Upgrade http:// to https:// in 8 files: General-Installing-Instructions.md, Graph-Templates.md, How-To-SSH-Tunnels.md, Plugin-Development.md, Standards-Code-Formatting.md, Templates.md, Upgrading-Cacti-Under-Windows.md - Replace two dead docs.cacti.net wiki links: How-To-SSH-Tunnels.md: old wiki SNMP guide -> Net-SNMP man page Plugin-Syslog.md: dead plugin:syslog.config -> plugin_syslog repo Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: fix technically inaccurate MySQL configuration recommendations - innodb_additional_mem_pool_size: removed in MySQL 5.7.4 / MariaDB 10.0; replaced with removal notice in Requirements.md and comments in Install-Under-CentOS_LAMP.md and Install-Under-CentOS_LEMP.md - max_heap_table_size: clarify ">= 5" means ">= 5% of system RAM" - innodb_buffer_pool_size: clarify ">= 25" means ">= 25% of system RAM" Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: add missing required PHP extensions to Requirements.md Add dom, mysqlnd, pcntl, Phar, and sqlite3 — all declared as required in composer.json but absent from the module list. pcntl is Linux-only (process control for the poller). Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: fix 36 spelling errors across 19 documentation files Corrections detected by codespell: - somone->someone, Walkthough->Walkthrough, GUAGE->GAUGE - asociate->associate, messege->message, therefor->therefore - get's->gets, Proxys->Proxies, paralelisation->parallelization - parms->params (6 instances in script data query examples) - finialise->finalise, buildin->built-in, everytime->every time - Unistall->Uninstall, resiliant->resilient, build-in->built-in - requriments->requirements (2 instances), explanitory->explanatory (3 instances) - fro->for, invole->involve, reulting->resulting - stauts->status, tge->the Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: add codespell spelling check workflow for documentation Adds GitHub Actions workflow that runs codespell==2.4.1 on all Markdown files on every push/PR to main. Also adds .codespell.cfg to skip binary and generated files (JSON, shell scripts, HTML, images). Update .gitignore to allow .github directory (was blocked by .git* glob). Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: improve voice, consistency, and note formatting across 10 files - Convert passive/impersonal constructions to active voice - Standardize NOTE -> Note in blockquotes for consistency - Reformat inline IMPORTANT/Note callouts as blockquotes - Fix awkward phrasing in LXC container notes - Consolidate fragmented note bullets into single blockquote Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: fix technical accuracy and correct typos across 10 files - Requirements.md: clarify Composer is for source/develop installs only; RRDtool minimum updated to 1.5+ (1.8+ for 1.3.x); php-snmp section rewritten to describe selective fallback behavior; SELinux/AppArmor advice reworded to recommend policy exceptions over blanket disable - Spine.md: fix PHP Script Server range (10 -> 15); fix 'senstivive' and 'Davices' typos - Trees.md: fix broken table rows split across lines; 'Sporting' -> 'Sorting' - Data-Sources.md: restructure storage table to standard 3-column layout; fix '19b' unit typo -> '19kb' - How-To-SNMP-Custom-Script.md: convert bold/backtick commands to proper fenced code blocks; fix 'intex' and 'BNSMPD' typos - Plugins.md: fix 'onfiguration' typo; fix YouTube thumbnail http -> https; fix 'Tuturial' typo - Standards-Security.md: fix 'invalidate' -> 'invalid' - template_apache_config.md: fix 'apcache2' -> 'apache2' - device-template-specific-proxmox.md: replace service file edit with drop-in approach; remove ProtectSystem=off/ProtectHome=off; add note on minimal required systemd overrides - resource/xml/query_interface_traffic.php: http -> https URL Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: rename CentOS install guides to Enterprise Linux; fix grammar, logic, and security flaws - Rename Install-Under-CentOS_LAMP.md → Install-Under-Enterprise-Linux-LAMP.md - Rename Install-Under-CentOS_LEMP.md → Install-Under-Enterprise-Linux-LEMP.md - Update README.md ToC links to match new filenames and correct labels LAMP fixes: - Title updated to reflect RHEL/Rocky Linux/AlmaLinux coverage - Fix step numbering: "2.Install" / "3.Enable" missing space after number - Spine build deps: restructure for EL7/EL8/EL9+ separately; EL8 was missing package install after repo enable; EL9+ uses 'crb' not 'powertools' - SELinux URL: fix quadruple-slash typo; switch to English wiki URL LEMP fixes: - Title: "CentOS 7" → "Enterprise Linux (RHEL / Rocky Linux / AlmaLinux)" - TLS: remove TLSv1 and TLSv1.1 (RFC 8996 prohibited, fails OpenSSL 3.x); set ssl_protocols TLSv1.2 TLSv1.3 - Ciphers: remove DH+3DES (Sweet32 / CVE-2016-2183) - HTTP redirect: uncomment return 301 (comment claiming nginx lacks support for 'return' has been wrong since nginx 0.8 / 2009) - PHP location block: fix 'alias' → 'root' (alias breaks $document_root in fastcgi_param SCRIPT_FILENAME); add missing semicolon after index directive - Cron: poller path was /var/www/html/cacti but install target throughout this guide is /usr/share/nginx/html/cacti — align them - DB: split GRANT...IDENTIFIED BY into CREATE USER + GRANT (IDENTIFIED BY on GRANT removed in MySQL 8.0 / MariaDB 10.5.2) - Fix comment typo: "Compression increases performance0" → remove trailing 0 - SELinux URL: fix quadruple-slash typo README.md: - Update section 3.1 and 3.2 links to new filenames - Correct labels from "CentOS 7" to "Enterprise Linux" - Fix "Reports Admistrative Interface" → "Administrative" - Fix "requriments" (×2) → "requirements" * docs: remove Install-Under-CentOS_LAMP.md (superseded by Install-Under-Enterprise-Linux-LAMP.md) * docs: remove Install-Under-CentOS_LEMP.md (superseded by Install-Under-Enterprise-Linux-LEMP.md) * docs: update README ToC links and fix typos - Update 3.1 and 3.2 links from CentOS to Enterprise Linux filenames - Correct labels: "CentOS 7" → "Enterprise Linux (RHEL/Rocky/AlmaLinux)" - Fix "Reports Admistrative" → "Reports Administrative" - Fix "requriments" (×2) → "requirements" * docs: fix grammar, logic, and technical errors in remaining install/upgrade guides Installing-Under-Windows.md: - Replace php_mysql.dll with php_pdo_mysql.dll (php_mysql removed in PHP 7.0) - Remove IIS ISAPI steps referencing php8isapi.dll (ISAPI dropped in PHP 8.0); replace with FastCGI instructions via php-cgi.exe - Remove NO_AUTO_CREATE_USER from sql_mode (removed MySQL 8.0, breaks startup) - sort_buffer_size = 200M → 32M with caveat (per-session; 200M causes OOM under load) - Fix step numbering gaps: main list 5→8, IIS 3→5, Finishing 5→8 - "you will have to user 8.3 notation" → "use" - "c:cygwin" → "c:\cygwin" (missing backslash) - "it's subfolders" → "its subfolders" - "A anm example" → "An example" - "verify/udate" → "verify/update" Installing-Under-Ubuntu-Debian.md: - Cron user: apache → www-data (apache user does not exist on Ubuntu/Debian) - CREATE DATABASE: use utf8mb4 directly; remove redundant ALTER DATABASE - php8.1-mbstring listed twice in apt-get install; deduplicated - "may received" → "may receive" - Note php8.1 is EOL; recommend checking current supported release Upgrading-Cacti-Under-Windows.md: - Fix all steps numbered 1. → proper sequential numbering (1–10) - Remove hardcoded MySQL 5.7 path; use generic %MYSQL_HOME% note Upgrading-Cacti-Under-FreeBSD.md: - mysqldump: remove contradictory -l / --lock-tables=false flags; replace with --single-transaction (correct for InnoDB, no locking) How-To-SSH-Tunnels.md: - Add prominent note: SSH -L is TCP-only; standard SNMP uses UDP; this guide requires TCP transport configured on snmpd and does not work for most network devices - Fix unclosed code fence after ssh-keygen output block - Replace rc.local persistence with systemd unit (rc.local is deprecated and disabled by default on systemd distros: Ubuntu 16.04+, Debian 9+) - ssh-keygen: recommend ed25519 over RSA * docs: correct PHP 8.1 EOL date, Net-SNMP link, and grammar PHP 8.1 security support ended 31 December 2025, not November 2024. Point the snmpd.conf link at www.net-snmp.org (the sourceforge.io mirror is bot-blocked). Fix 'There a two ways extending' to 'There are two ways to extend'. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: fix spelling workflow trigger to target develop, not main The repo's default branch is develop; main hasn't moved since 2023. The workflow's push/pull_request filters targeted main, so it never ran on any PR opened against develop. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
3.6 KiB
User Group Management
Cacti supports from one to many static User Groups in the current design. User Groups closely mimic the normal user. You see things like Graph permissions, Roles and Realms, Default pages, and settings, it's all there.
The way that a Cacti User Group works is that it's combined with the Users permission, and then the resulting permission is the most permissive. So, if a User does not have a permission, but the User Group that they belong to does, the user then gains the permission.
There are other types of settings that the User Group can own the permission as well. There are only a few of these permissions however.
In the next series of images, we will walk through the User Group interface. In this first images, we can see the main User Group interface. From here, you can see all of the Groups defined on the system and the number of Users in the Group, if the User Group is enabled or disabled. Lastly, in the Action drop-down, you can see the actions that you can take with a User Group.
In this next image, you can see the User Group Edit page. The Edit page has multiple Sub-tabs. They include:
- General - General settings about the User Group
- Members - A list of User Group members
- Permissions - Roles and Realms that provide group member access to Cacti components
- Graph Perms - Effective Graph Permissions, rolling up Device and Template permissions
- Device Perms - User Group Device Permissions
- Template Perms - Graph Template Permissions
- Tree Perms - Tree Permissions
- User Settings - Settings for the User of the Group if they can not manage settings on their own
The first form elements are pretty self explanatory. The Tree, Graph List, and Preview rights speak to Cacti three Graph Viewing modes which are explained in the Viewing Graphs section of the Document.
Lastly Login options, are how the user should be re-directed after logging. This is again, pretty self explanatory.
The next image shows the Member list. This one is pretty self explanatory. You can see all the users defined on the system and whether or not they below to the User Group, and the ability to add or remove them enmass.
The next image shows Cacti's Roles and Realms within those Roles. Cacti organizes it's Authorization Realms into Pre-defined Roles. Plugin Developers can create their own Roles as well. So, when you Extend Cacti using Plugins, you may find additional Roles.
In this last image on the page, you can see every Graph in the Cacti system and whether or not the User Group has permission to view it. This permission can granted by giving the Group permission to a Device or the Graph Template in the Permissive permission mode, or in the Restrictive permission mode, they have to have both Device and Graph Template permissions to gain access to the Graph. Finally, the Cacti Administrator can grant access to Graphs one at a time if they choose.
You can find the Permission and Restrictive permission setting on Cactis
configuration page at Console > Configuration > Settings > General. We have
not covered the Device, Template, Tree or Settings sub-tabs
here. If you would like more information on them, see the User documentation.
Copyright (c) 2004-2026 The Cacti Group