Least permissions

Ansible Tower

For OneFuse Ansible Tower Modules.

1. Create or determine the Service Account for the OneFuse Ansible Tower Module.
2. Log in to Ansible Tower as an Administrator.
3. Go to Access > Users.
4. Add the Service Account via either Local Users or LDAP User Account (do not use Social, Azure AD, or Kerberos). If the desired Service Account already exists, edit the user.

   1. Under the Details section for the user, verify the following:

      Setting	Selection
      User Type	Normal User

   2. Select Save.

   3. Under the Permissions tab for the Service Account, perform the following:

      Resource	Selection	Role
      Organizations	Select all Organizations OneFuse will integrate with	Member
      For granular permissions instead of at an Organizational level, set below:
      Projects	Select all Projects OneFuse will integrate with	Use
      Job Templates	Select all Job Templates OneFuse will integrate with	Execute
      Inventories	Select all Inventories OneFuse will integrate with	Inventory Admin

   4. Save the user.

BlueCat

For OneFuse BlueCat IPAM and/or DNS Modules.

1. Create or determine the Service Account for the OneFuse BlueCat Module IPAM and/or DNS.
2. Log in to BlueCat as an Administrator.
3. Go to Administration > Users and Groups.
4. Add the Service Account via either Local Users or Groups. If the desired Service Account already exists, edit the user.

   1. Under User Access for a Local User, verify the following:

      Setting	Selection
      Administrator	Do not check the Administrator checkbox
      Security Privilege	No Access
      History Privilege	Hide
      Access Type	API

   2. Under General for a Group, verify the following:

      Setting	Selection
      Administrator Privilege	Do not check the Administrator checkbox

   3. Save the user or group.

5. Grant rights to the BlueCat Configuration:

   1. Go to Administration > Configurations.

   2. Select the desired Configuration from the Configuration list.

   3. Scroll down to Access Rights and select New Access Right….

   4. Select the Service Account Local User or Group and select Add.

   5. Select the following:

      Setting	Selection
      Access Right
      Default Access	View
      Default Access	Quick Deployment (checked)
      Overrides
      IPv4 Objects
      IPv4 Address	Full Access
      Resource Records
      Alias Record	Full Access
      Host Record	Full Access

   6. Select Add to save the Configuration’s Access Rights.

Infoblox

For OneFuse Infoblox IPAM and/or DNS Modules.

1. Create or determine the Service Account for the OneFuse Infoblox Module IPAM and/or DNS.

2. Log in to Infoblox UI as an Administrator.

3. Go to Administration > Administration > Groups.

4. Add a new Infoblox Admin Group:

   Setting	Selection
   Step 1 of 8 - Allow access from
   Allow access from	Any
   Step 5 of 8 - Roles
   Allowed Interfaces	API (required); GUI (recommended for troubleshooting); Cloud API only (No PAPI)

5. Save the new Infoblox Admin Group.

6. Select the Permissions tab.

7. Select + to Create a New Permission.

   1. Select the Infoblox Group from Step 4 from the dropdown for Group Permission.

   2. Select the following from the Permission Type dropdown and check the specified permissions:

      IPAM permissions (Infoblox IPAM OneFuse Module):

      Resource/Functions	Read/Write	Read-Only
      All Network Views		Yes
      All Hosts	Yes

      DHCP permissions (Infoblox IPAM OneFuse Module):

      Resource/Functions	Read/Write	Read-Only
      All Network Views		Yes
      All Hosts	Yes
      All IPv4 DHCP Fixed Addresses/Reservations	Yes

      DNS permissions (Infoblox DNS OneFuse Module):

      Resource/Functions	Read/Write	Read-Only
      All DNS Views		Yes
      All Hosts	Yes
      All A Records	Yes
      All PTR Records	Yes

      Grid permissions (only for using Infoblox with Microsoft DHCP Ranges):

      Resource/Functions	Read/Write	Read-Only
      All Microsoft Servers	Yes

   3. Select Save & Close to save the Permissions.

8. Add or verify that the Service Account is in the Infoblox Admin Group.

Men&Mice Micetro

For OneFuse Men&Mice Micetro IPAM and/or DNS Modules.

1. Create or determine the Service Account for the OneFuse Men&Mice Micetro Module IPAM and/or DNS.
2. Log in to Men&Mice Micetro Management Console as an Administrator.
3. Go to Tools > User Management > Roles.
4. Select Add to add a new Role.
   1. Provide a Name (for example, OneFuse_WebAccess) and optional Description.
   2. Select OK.
5. Select Tools > Global Access.
   1. Under Group, role or user names, select Add and add the Role created in Step 4.
   2. Under Permissions for <Role Name>, select the following:
      • Access to the web interface (checked)
   3. Select OK to save.
6. Add the Service Account to either Users or Groups. If the desired Service Account already exists, edit the user.
   • Under Roles, select the following:
     • The Role created in Step 4 (checked)
     • DNS Administrators (built-in): for the Men&Mice Micetro DNS OneFuse Module
     • IPAM Administrators (built-in): for the Men&Mice Micetro IPAM OneFuse Module
   • Select OK to save.

Microsoft

For the following OneFuse Microsoft Module(s): Active Directory, DNS, and IPAM.

1. Verify Windows NTP is set up correctly.
2. Create or determine the Service Account for the OneFuse Microsoft Module(s) Active Directory, DNS, and/or IPAM.

Jump server

Perform the following if utilizing an OpenSSH Jump Server to the target AD/DNS and/or IPAM server.

Perform the following on all Windows Jump Server(s):

RSAT (Remote Server Administration Tools):

Resource: Remote Server Administration Tools

1. Log in to the Jump Server as an Administrator.

2. Open Server Manager and select Manage > Add Roles and Features.

3. Accept defaults and select Next until the Server Selection tab.

4. Select the desired server from the list in Server Selection and select Next.

5. Accept defaults and select Next for Server Roles.

6. In the Features tab, scroll down and select Remote Server Administration Tools:

   Module	Role(s)
   Active Directory	Role Administration Tools: AD DS and AD LDS Tools
   DNS	Role Administration Tools: DNS Server Tools
   IPAM	Feature Administration Tools: IP Address Management (IPAM) Client

7. Select Next.

8. Optionally have the server restarted, or leave the option unchecked and select Install.

9. Select Close.

10. Once installation completes, select Tools on the top-right menu of the Server Manager. Verify the following is listed:

    • Active Directory: Active Directory Users and Computers
    • DNS: DNS

Local temporary folder permissions:

1. Create a folder for storing OneFuse PowerShell Scripts (for example, C:\OneFuse).
2. Add the Service Account to the Group or user names for the Temporary Folder with the following Allow permissions:
   • Modify
   • Read & execute
   • List folder contents
   • Read

Permission to run remote PowerShell scripts:

1. Log in to the Jump Server as an Administrator.

2. Open PowerShell.

3. Run the following command and confirm when prompted.

   This action could have a serious impact on your system and will enable other users/groups to run commands on the server.

   Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI
   

4. Add the Service Account to Select Users, Computers, Service Accounts, or Groups with the following Allow permissions:

   • Full Control (All Operations)

5. Select OK and then confirm Yes to apply the change.

Set WMI Control settings:

1. Log in to the Jump Server as an Administrator.
2. From the Computer Management console, expand Service and Applications.
3. Right-click on WMI Control and select Properties.
4. Select the Security tab.
5. Expand the Root folder and select CIMV2, then select the [Security] button.
6. Add the Service Account to the Groups or user names.
7. Select the Service Account and select Advanced next to “For special permissions or advanced settings”.
8. On the Permissions tab, select the desired user in Permissions entries and select Edit.
9. Select the following permissions:
   • TYPE: Allow
   • APPLIES TO: This namespace and subnamespaces
   • PERMISSIONS: Execute Methods, Enable Account, Remote Enable
10. Select OK to apply the changes.

Add the IPAM server to the Jump Server’s server pool:

1. Log in to the Jump Server as an Administrator.
2. Open Server Manager and right-click on All Servers, then select Add Servers.
3. In the Add Servers wizard, enter the IPAM Server Name and select Find Now.
4. Highlight the server name, select the arrow in the center to add it to the list, and select OK.
5. The IPAM server will appear in the list of servers.
6. Repeat for each IPAM server.

Active Directory

Perform the following on all Windows servers for Microsoft Active Directory to enable creating, moving (optional), and deleting Computer Objects; creating and deleting OUs; and adding Computer Objects to Security Groups.

Source: Delegating Administration by Using OU Objects

Service:

1. Verify Active Directory Web Services (ADWS) is installed. For Windows Server 2012 and newer, ADWS is pre-installed.
2. Recommended: Configure ADWS to start automatically on all servers.

Computer Object delegation rights:

Delegate the following permissions to the Service Account on the appropriate OU to create/delete (and move) Computer Objects.

1. Create a Custom Task to delegate only on Computer Objects.
2. Select the following permissions for Create selected objects in this folder and Delete selected objects in this folder:
   • Read all properties
   • Create all child objects
   • Delete all child objects
3. If planning on building computers into a Build OU, add the following permissions:
   • Read
   • Write

OU Object security rights:

Delegate the following permissions to the Service Account on the appropriate OU to create/delete OUs within the specified OU.

1. In the Properties of the OU, go to Security > Advanced and select Add New Permissions.
2. Select the desired Service Account and add the following:
   • TYPE: Allow; APPLIES TO: This object and all descendant objects; PERMISSIONS: List Contents, Read all properties, Write all properties, Read permissions, Create Organization Unit objects, Delete Organization Unit objects
   • TYPE: Allow; APPLIES TO: Descendant Organizational Unit objects; PERMISSIONS: List Contents, Read all properties, Write all properties, Read permissions, Delete, Create Organization Unit objects, Delete Organization Unit objects

AD Security Group permission set:

Delegate the following permissions to the Service Account on the appropriate OU to place Computer Accounts into Security Group(s):

• Modify the membership of a Group

DNS

Perform the following on all Forward and/or Reverse DNS Zones on Windows servers for Microsoft DNS.

Configure Read-Access permissions to the top DNS server layer:

1. In the DNS Manager window, right-click and select Properties of the DNS server.
2. Add the Service Account with the following permissions:
   • Read

Configure Forward Lookup Zone(s):

1. In the DNS Manager window, right-click on the Forward Zone where records are being registered.
2. In the Security tab, add the Service Account to the users list.
3. Select Advanced to verify the following permissions:
   • TYPE: Allow
   • APPLIES TO: This object and all descendant objects
   • PERMISSIONS: List Contents, Read all properties, Write all properties, Delete, Delete subtree, Read permissions, Modify permissions, Modify owner, All validated writes, Create all child objects, Delete all child objects
   • All Properties should be selected/checked.

Configure Reverse Lookup Zone(s):

1. In the DNS Manager window, right-click on the Reverse Lookup Zone where records are being registered.
2. In the Security tab, add the Service Account to the users list.
3. Select Advanced to verify the following permissions:
   • TYPE: Allow
   • APPLIES TO: This object and all descendant objects
   • PERMISSIONS: List Contents, Read all properties, Write all properties, Delete, Delete subtree, Read permissions, Modify permissions, Modify owner, All validated writes, Create all child objects, Delete all child objects
4. All Properties should be selected/checked.

IPAM

Perform the following on all Windows servers for Microsoft IPAM.

Services:

1. Verify IPAM client is installed:
   1. Server Manager > Manage > Add Roles and Features.
   2. Accept defaults and select Next until the Features option.
   3. Expand Remote Server Administration Tools > expand Feature Administration Tools.
   4. Select IP Address Management (IPAM) Client.
   5. Confirm and select Install.
2. Enable non-local administrators to run IPAM cmdlets in PowerShell (see Microsoft’s IPAM documentation).

Run IPAM PowerShell cmdlets:

1. Follow Microsoft’s instructions for enabling non-local administrators to run IPAM cmdlets in PowerShell.

Service Account in Remote Management Users:

1. Verify the Service Account is part of the following built-in Windows Group to allow remote connectivity:
   • Remote Management Users

Microsoft IPAM Roles:

1. Verify the Service Account has the following Built-in Roles in Microsoft IPAM:

   • IP Address Record Administrator Role, or a custom role with: Create IP address, Edit IP address, Delete IP address
   • DNS Record Administrator Role, or a custom role with: Create DNS resource records, Delete DNS resource records

   Source: View Roles and Role Permissions

ServiceNow

For OneFuse ServiceNow CMDB Module and/or OneFuse ServiceNow Connector.

1. Create or determine the Service Account for the OneFuse ServiceNow CMDB Module and/or ServiceNow Connector.

2. Log in to ServiceNow as an Administrator.

3. Go to User Administration > Users.

4. Add the Service Account to Users and select Submit.

5. Once the desired Service Account exists, edit the user.

6. Select the Roles tab and add/verify the following Roles:

   OneFuse Module	OneFuse purpose	Role(s)
   ServiceNow Connector	Specific MID Server Account	mid_server
   ServiceNow Connector	OneFuse Service Account	x_sovla_onefuse.admin; mid_server only if this account will also be used as the MID Server account
   ServiceNow CMDB	OneFuse Service Account	asset (to add and update records); itil (to utilize the ServiceNow IRE API); web_service_admin (to utilize the ServiceNow API)

7. Select Update to save.

SolarWinds

For OneFuse SolarWinds IPAM Module.

1. Create or determine the Service Account for the OneFuse SolarWinds Module IPAM.

2. Log in to SolarWinds Orion as an Admin.

3. Go to Admin > Accounts > Manage Accounts.

4. Add the Service Account to either Individual Accounts, Windows Groups, or SAML Groups. If the desired Service Account already exists, edit the user.

5. Under Default Summary View, select to expand IP Address Manager Settings and verify the following:

   Setting	Selection
   IPAM Summary View	IP Address Manager
   IPAM Address Details View	IPAM IP Address Details - IP Address Details
   IPAM DHCP Server View	DHCP Server Details
   IPAM Roles & Permissions	Power User: read/write access and can initiate scans to all subnets. Full access to DHCP and DNS management.

6. Select Submit to save.

VMware Aria Automation

For OneFuse VMware Aria Automation Module.

• For VMware Aria Automation 8x/Cloud, refer to the VMware Aria Automation installation and setup section to create the OneFuse Service Account or API Token.
• For VMware vRealize Automation 7.6, refer to the VMware vRealize Automation 7.6 installation and setup section to create the OneFuse Service Account.