User Account Administration

11.1 Understanding User Security Levels

11.2 Accessing ViewRunner for HP OpenView

11.3 Adding Users

11.4 Modifying and Deleting Users

11.5 Using the Menu Bar to Define Users

11.6 Changing Passwords

11.7 Disabling Users

User Account Administration

The "User Accounts Administration" chapter explains how to add/modify/delete users and how to add/modify user passwords. It also explains the different levels of user security that ViewRunner for HP OpenView provides.

For the purposes of this guide, the term "user" refers to any user of the Cisco ViewRunner software, not to the specific security level described in this section.

11.1 Understanding User Security Levels

ViewRunner for HP OpenView provides three levels of user security:

Administrator - These users have read-write access to ViewRunner for HP OpenView, can make changes to the system, and can add, delete, modify, and disable users. They can also change users' passwords. (Users can change their own passwords by using the Security->Change Password menu option.)
- Disabled users are logged out immediately, and they cannot log back in until they have been re-enabled.
- Passwords must contain at least 6 character, at least 2 of which are alphabetic and one of which is numeric or a special character.

: Administrators are the only users who can create/move domains and can move Cisco 6100s from the New Equipment window to a Wire Center, or between Wire Centers.

Operator - These users have read-write access to the Cisco 6100 and can make configuration changes (as defined by the Administrator), but cannot set up additional users or change passwords.
Guest - These users have read-only access to the Cisco 6100 and cannot make any ViewRunner for HP OpenView or the Cisco 6100 configuration changes. Read access can be restricted to certain Wire Centers by an Administrator.

Administrator, Operator, and Guest users all can use ViewRunner for HP OpenView to do the following tasks. Operators and Guests, however, can be restricted to specific Wire Centers.

Automatically discover (identify) Cisco equipment.
Collect configuration and status information about the Cisco 6100.
Collect, filter, store, and sort alarms from the Cisco 6100 system.

Note All users can be restricted to actions within specific Wire Centers. However, restricting Administrators is a self-imposed restriction, since Administrators can change the Wire Center access restrictions for any user, including their own.

The following table outlines specifically what each level of user security allows:

Table 11-1: User Administration Privilege Levels
User Action Administrator Operator Guest

Create Location

Yes

No

No

Delete Location

Yes

No

No

Create Wire Center

Yes

No

No

Delete New Equipment Wire Center

No

No

No

Delete Wire Center

Yes

No

No

Add 6100 to:

New Equipment Wire Center

Wire Center

Yes

Only if the Wire Center is in the Operator's Allowed Locations list and the Operator has permission to add Cisco 6100s

No

Delete 6100 from:

New Equipment Wire Center

Wire Center

Yes

Only if the Wire Center is in the Operator's Allowed Locations list and the Operator has permission to delete Cisco 6100s

No

Move 6100 from:

One Wire Center to another

New Equipment Wire Center to a Wire Center

Wire Center to the New Equipment Wire Center

Yes

Only if both Wire Centers are in the Operator's Allowed Locations list and the Operator has permission to add Cisco 6100s to and delete Cisco 6100s from Wire Centers

No

View LoopRunner (6100 Chassis View options)

All

Cisco 6100s in unrestricted Locations only

Cisco 6100s in unrestricted Locations only

Map configuration options:

Add 6100s to Wire Centers

Delete 6100s from Wire Centers

All

Cisco 6100s in unrestricted Locations only (add and delete permissions can be explicitly granted or denied)

No

Move Wire Center to a new Location

Yes

No

No

Move Locations under a different Location

Yes

No

No

6100 Configuration options:

Configure Chassis

Configure Module

Configure Subscriber

Configure Pool

NVRAM Save

NVRAM Restore

Software Download

Configure management communication

All

Cisco 6100s in unrestricted Locations only (permissions for each option can be explicitly granted or denied)

No

Remove 6100 from Subtend Group

Yes

No

No

Create/Delete Subtend Location

Yes

No

No

Create/Delete Subtend Group

Yes

No

No

Create/Delete Subtend Connection

Yes

No

No

Add to new Subtend Group

Yes

No

No

Paste 6100 into Subtend Group

Yes

No

No

Table 11-1: **User Administration Privilege Levels**
User Action	Administrator	Operator	Guest
Create Location	Yes	No	No
Delete Location	Yes	No	No
Create Wire Center	Yes	No	No
Delete New Equipment Wire Center	No	No	No
Delete Wire Center	Yes	No	No
Add 6100 to: New Equipment Wire Center Wire Center	Yes	Only if the Wire Center is in the Operator's Allowed Locations list and the Operator has permission to add Cisco 6100s	No
Delete 6100 from: New Equipment Wire Center Wire Center	Yes	Only if the Wire Center is in the Operator's Allowed Locations list and the Operator has permission to delete Cisco 6100s	No
Move 6100 from: One Wire Center to another New Equipment Wire Center to a Wire Center Wire Center to the New Equipment Wire Center	Yes	Only if both Wire Centers are in the Operator's Allowed Locations list and the Operator has permission to add Cisco 6100s to and delete Cisco 6100s from Wire Centers	No
View LoopRunner (6100 Chassis View options)	All	Cisco 6100s in unrestricted Locations only	Cisco 6100s in unrestricted Locations only
Map configuration options: Add 6100s to Wire Centers Delete 6100s from Wire Centers	All	Cisco 6100s in unrestricted Locations only (add and delete permissions can be explicitly granted or denied)	No
Move Wire Center to a new Location	Yes	No	No
Move Locations under a different Location	Yes	No	No
6100 Configuration options: Configure Chassis Configure Module Configure Subscriber Configure Pool NVRAM Save NVRAM Restore Software Download Configure management communication	All	Cisco 6100s in unrestricted Locations only (permissions for each option can be explicitly granted or denied)	No
Remove 6100 from Subtend Group	Yes	No	No
Create/Delete Subtend Location	Yes	No	No
Create/Delete Subtend Group	Yes	No	No
Create/Delete Subtend Connection	Yes	No	No
Add to new Subtend Group	Yes	No	No
Paste 6100 into Subtend Group	Yes	No	No

11.2 Accessing ViewRunner for HP OpenView

When ViewRunner is installed, it creates a single Administrator account with the login ID of vradmin and password of cisco123. This account cannot be deleted to guarantee that there is always one user account defined in the system. After installation, the password should be changed to something other than the default to protect the system from unauthorized access.

To access the ViewRunner for HP OpenView program the first time, you should start HP OpenView from the command line of the host running the HP OpenView Network Node Manager. As follows:

Step 1 Login to the host running the HP OpenView Network Node Manager. (In this example, the host is called "centerice".)

Step 2 Source the proper .cshrc file by entering the following sequence of commands:

centerice:1> cd /opt/CSCOvrovc/env
centerice:2> source vrc.cshrc
centerice:3> cd ~
centerice:4> ovw &

Figure 11-1: UNIX Xterm Window (HP OpenView NNM Host)

Step 3 Entering ovw & at the command prompt causes HP OpenView to start, and the ViewRunner Login Window screen appears:

Figure 11-2: ViewRunner Login Window

Table 11-2: ViewRunner Login Field Definitions
Field Description

Login ID

Prompts you for your user name.

Password

Prompts you for your password.

**Table 11-2: ViewRunner Login Field Definitions**
Field	Description
Login ID	Prompts you for your user name.
Password	Prompts you for your password.

Note If you are not the Administrator, and the Administrator has not created a valid ID and password for you, you will not be able to log in to ViewRunner for HP OpenView.

The fields above are both case sensitive and are limited to a maximum of 11 characters. In addition, the password selection has the following limitations:

Contains at least six characters
Contains at least two alphabetic characters
Contains at least one numeric or special character
Does not contain the user name in any order

Step 4 Enter your login name and password. The system defaults for Login ID and Password are vradmin and cisco123.

Caution
Be sure to change the default password to limit access to the system once you are logged in.

11.3 Adding Users

When you log in to the system the first time or when you choose the User Administration option from the Root->Security drop down menu (see "Using the Menu Bar to Define Users"), ViewRunner for HP OpenView automatically brings up the ViewRunner Administration Window:

Figure 11-3: ViewRunner Administration Window

Table 11-3: ViewRunner Administration Window Field Definitions
Field Description

User Name

Displays name of a user.

Permission Level

Displays the permission level for this user, either Guest, Operator, or Administrator.

Full Name

Displays the full name of the user.

**Table 11-3: ViewRunner Administration Window Field Definitions**
Field	Description
User Name	Displays name of a user.
Permission Level	Displays the permission level for this user, either Guest, Operator, or Administrator.
Full Name	Displays the full name of the user.

Note The options for Modify or Delete a user are grayed out initially on the ViewRunner Administration Window. If you wish to modify user settings or delete a user, you must select a user in the list of current users to activate those options.

The ViewRunner Administration Window contains a list of all the current users. To add a user, follow the instructions below:

Step 1 Click on the Add button. The Add User window appears.

Figure 11-4: Add Operator Window

Step 2 Enter the name of the new user in the User Name field. User names can be no longer than twelve keyboard characters. Blank characters are permitted.

Step 3 Assign a permission level to the user by clicking on the button to the right of the Permission Level field. A drop down menu appears with three options: Guest, Operator, and Administrator. Select one.

Note that if the user permission level is Guest, then the User Permissions list to the right of the window is grayed out. Guests have read-only access, so they cannot perform any kinds of configurations.
If the user permission level is Operator, then the User Permissions list is available for you to select what types of permissions you want to assign this Operator.
If the user permission level is Administrator, then by default all the permissions in the User Permissions list are checked and thus given to the new Administrator.

Step 4 Enter the complete name of the user in the Full Name field.

Step 5 Set the account security options for an Administrator or an Operator by selecting all or any combination of configuration options:

Configure Chassis
Configure Module
Configure Subscriber
Configure Pool
Add 6100
Delete 6100
Save 6100 Configuration
Restore 6100 Configuration
Download 6100 Software
Restrict 6100 Settings

Step 6 Assign Wire Center rights for the user by selecting from the list of available Wire Centers. Move Wire Centers from the Denied Wire Centers area to the Allowed Wire Centers area by selecting a domain then clicking on the Allow button.

To restrict Wire Center rights altogether, click on the Restrict Wire Centers field. This greys out the list of available Wire Centers.

Note

New Equipment

Step 7 Assign an initial password to a new user by clicking on the Set Initial Password button. The following pop up window appears:

Figure 11-5: Change Password Window

Step 8 Enter the password in the New Password field. Enter the password again in the Confirm field. Click on the OK button.

Note

The Administrator may create a user account with no password assigned. In that cast, the ViewRunner Login Window reappears when a user not assigned an initial password attempts to login for the first time. On that screen, the user must supply a new password and confirm it.

Step 9 Click on the Apply button to apply all the new settings for the newly created user.

Step 10 Click on the OK button to return to the Root window.

11.4 Modifying and Deleting Users

An Administrator may modify user settings and/or delete users. Follow the instructions below to modify user settings or to delete users:

Step 1 At the ViewRunner Administration Window, click on the user name you want to modify or delete. This activates the Modify and Delete buttons:

Figure 11-6: ViewRunner Administration Window

Step 2 To delete the user, simply click on the Delete button. This deletes the selected user. The Administrator can delete multiple users using the mouse or Ctl-Shift to select more than one user before clicking the Delete button.

Notice that in the figure shown here, the Delete button is grayed out because the user selected was vradmin, a user which cannot be deleted.

Step 3 To modify user settings, click on the Modify button. The Modify User window appears, displaying the settings to modify (see Figure 11-7). The Administrator may then toggle the permissions to change what the user is or is not allowed to configure and may change domain restrictions if desired.

Step 4 The Administrator may also change a user's password if desired. Clicking on the Change Password button will open the Change Password window. See Figure 11-5 for an example of the Change Password window.

Figure 11-7: Modify User Window

11.5 Using the Menu Bar to Define Users

To define additional Administrator, Operator, and Guest accounts after initial access, select the Security option from the Root menu. Then select the User Administration option from the drop down menu.

Figure 11-8: ViewRunner Root Window

The ViewRunner Administration Window appears (see Figure 11-3). Follow the instructions in "Adding Users" and "Modifying and Deleting Users" to add, delete or modify users.

11.6 Changing Passwords

To change a user's password, select the Security option from the Root menu. Then select the Change Password option from the drop down menu. The Change Password screen appears:

Figure 11-9: Change Password Window

Enter the old and new passwords in the specified fields. Confirm the new password by entering it again in the Confirm field. To accept, click on the OK button.

Note Passwords must contain at least six (6) characters, at least two (2) of which must be alphabetic and one (1) of which must be a numeric or special character. In addition, the password must not contain the user's name in any order.

11.7 Disabling Users

An administrator may disable any user (other than vradmin) by toggling the User Enabled button in the Modify User window (see Figure 11-7). If the user is currently logged in, the session will be terminated immediately, and the user will no longer be able to log in. When an Administrator re-enables a user, the user is able to log in again.

Table of Contents

User Account Administration