There is a way to restrict client permissions? I have the latest version from SVN, and when I create a client and then login with his credentials I can create new sites (domains), DNS Zones, etc...
I'm answering my self: In fact we can change permissions modifying in the database the field "modules" in the "sys_user" table. But... there are not a interface to set permissions? Yes, there is an interface here: Log on as an Admin -> System tab ->Edit User (Left menu under the "CP User" label) -> Select a user And then we will have a UI to change the modules BUT there is a message saying: WARNING: Do not edit or modify any user settings here. Use the Client- and Reseller settings in the Client module instead. Modifying or changing Users or groups here may cause data loss! So I go in the "Client and reseller" settings but I don't find the UI to change access to modules. The question is where I can safely change the user permissions?
It's fine to add or remove client's modules there. It's not good though to add or remove clients in that fasion.
There are two types of limitations 1) hide a complete module for a client (if he can't see the module dns, he can't change anything) -> this is done under system -> edit user (the warning means not to change the username or the password) 2) set the number of a limitation -> this is done under User->edit client templates (here you can set the limitations and give them a name) and under client -> edit clients (here you can select a master template for limitation of the user. select a master-template ans click at save. if you come back, the restrictions of the master-template are submitted to the client. you can also edit additional templates (set all to 0 and only e-Mail to 5 and name it "+5 E-Mails". if you then add the additional tempalte to the master the number of email = limitation master-template + limitation additional template). so you can create a master called "web light", "web std" "web business" and if you neet "web light + 10 E-Mail" then select the master "web light" and add TWO times +5 E-Mails Hope, this helps Olli
Hello, I have just found this topic and have also a few questions regarding the user-permissions: We do not want our users to be able to create new domains, but they should be able to change settings for their already registered domains. We can at the moment either block their access to the "site"-Module completely, or they can add new domains, see all IP's the Server has, etc. And even change the Harddisk-Quota, etc. How can we limit the access-permissions? That is the same with the email-Addresses.. They should only be able to create eMail-Addresses for their own domains and not be able to create new domains... Thanks a lot and best regards, Christian
In the svn-version there is a new module called "domain". if you activate this module, your customer can only add a domain, you have added for them. Means, if you said "d1.com" and "d2.com" are their domains, they can add a e-Mail-Domain, but only "d1.com" or "d2.com" - no more. but! this is only experimental and only in the svn. DO NOT USE SVN IN PRODUCTION ENVIRONMENTS!!!
Thanks a lot for your quick reply I will then try to find out how to check out the svn-version... Do you have an ETA for this module? Will that module also block the user from changing quota-settings etc. for his domains? Thanks and best regards, Christian
No. No, as thats already the case in the current versions. Just create the site as admin, and the user cant chnage these settings. If you let users create sites themself, they are bound to the limits in their client settings, so they can not exceed their limits in that way too.
Till, thanks a lot for your reply! I have just tried it out: I can change the settings for a domain (as DomainOwner), but as soon as I click "Save", I get no error at all, my changes are simply not saved... Shouldn't the SelectBoxes and TextAreas be "disabled" if I cannot change them anyway? Regarding the permissions: I can set certain rights for the client (e.g. PHP-Settings, Amount of DBs, etc.) but how are those related to a domain? Example: A customer has two domains, one is the expensive hosting-plan which includes PHP and has 5 DBs, the other one is cheap and just has 5 MB File-Hosting, no scripting languages at all. How would I set the client up, so that he can, for example switch PHP ON/OFF for the expensive domain and cannot change anything regarding scripting for the other domain? Don't get my wrong, ISPConfig so far seems great, we just want to know how we can get our current settings/workflows done with it ;-) Thanks and best regards, Christian
In ISPConfig 3 you assign the limits to the client itself and not to a website. It does not make and different from a resource standpoint if a db is assigned to site a or b. Thats what the majority of hosting providers that use ispconfig wanted.
