Global File System permissions

To use the OGFS, you need to grant OGFS permissions. OGFS permissions are separate but related to the action permissions, resource permissions, and folder permissions described in Set permissions on user groups (see Set OGFS permissions).

The OGFS is a virtual file system that gives you access to all your managed servers and all their file systems. It underlies many SA Client actions, such as browsing managed server file systems and scanning servers for compliance. To perform actions that use the OGFS, you must belong to a user group that has OGFS permissions. The following table lists the operations you control with OGFS permissions.

OGFS Permissions

OGFS Permission	Tasks Allowed by this Permission
Launch Global Shell	Launch the Global Shell.
Log In To Server	Open a shell session on a UNIX server. In the SA Client, open a Remote Terminal. In the Global Shell, you can use the rosh command.
Read COM+ Database	Read COM Plus objects as a specific login. In the SA Client, use the Device Explorer to browse these objects on a Windows server.
Read Server File System	Read a managed server as a specific login. In the SA Client, use the Device Explorer to browse the file system of a managed server.
Read IIS Metabase	Read IIS Metabase objects as a specific login. In the SA Client, use the Device Explorer to browse these objects on a Windows server.
Read Server Registry	Read registry files as a specific login. In the SA Client, use the Device Explorer to view the Windows Registry.
Relay RDP Session To Server	Open an RDP session on a Windows server. In the SA Client, this is the Remote Terminal menu that opens an RDP client window for a Windows server.
Run Command On Server	Run a command or script on a managed server using the rosh utility, where that command or script already exists. In the SA Client, this is used for Windows Services accessed by the Device Explorer.
Write Server File System	Modify files on a managed server as a specific login. In the SA Client, you can use the Device Explorer to modify the file system of a managed server.

When setting an OGFS permission, in addition to specifying an operation such as Write Server File System, you also specify the managed servers to which the operation can be applied. You specify the managed servers by selecting a facility or a customer or a device group. You also specify the login name for the managed server where the operation runs. (The Launch Global Shell operation is an exception.)

For example, suppose you specify the Read Server File System permission. For the servers, you select a device group named Sunnyvale Servers. For the login name, you select the SA user name. Later, in the SA Client, the SA user jdoe opens a server belonging to the Sunnyvale Servers device group in the Device Explorer. In the Views pane, the string jdoe appears in parentheses next to the File System label. When the user drills down into the file system, the Device Explorer displays the files and directories to which the UNIX user jdoe has access.

If you specify a super user such as root for the login name, make sure that the resource you select only allows access to the correct set of servers. For root, you should limit access to servers by customer or device group, not by facility.

For the Launch Global Shell permission, you do not specify the managed servers, because a Global Shell session is not associated with a particular server. Also, you do not specify the login user for this permission. If you open a Global Shell session with the SA Client, you do so as your current SA login. If you open it with the ssh command, you are prompted for an SA login (user name).