ExtraHop 8.8 ExtraHop Trace Admin UI Guide
25
Users and user groups
Users can access the ExtraHop system in three ways: through a set of pre-configured user accounts,
through local user accounts configured on the appliance, or through remote user accounts configured on
existing authentication servers, such as LDAP, SAML, Radius, and .
Local users
This topic is about default and local accounts. See
to learn how to configure remote
accounts.
The following accounts are configured by default on ExtraHop systems but do not appear in the list of
names on the Users page. These accounts cannot be deleted and you must change the default password
upon initial login.
setup
This account provides full system read and write privileges to the browser-based user interface and
to the ExtraHop command-line interface (CLI). On physical appliances, the default password for this
account is the service tag number on the front of the appliance. On virtual appliances, the default
password is
default
.
shell
The
shell
account, by default, has access to non-administrative shell commands in the ExtraHop
CLI. On physical appliances, the default password for this account is the service tag number on the
front of the appliance. On virtual appliances, the default password is
default
.
Note:
The default ExtraHop password for either account when deployed in Amazon Web Services
(AWS) and Google Cloud Platform (GCP) is the instance ID of the virtual machine.
Next steps
•
Remote Authentication
The ExtraHop system supports remote authentication for user access. Remote authentication enables
organizations that have authentication systems such as LDAP (OpenLDAP or Active Directory, for example)
to enable all or a subset of their users to log in to the system with their existing credentials.
Centralized authentication provides the following benefits:
•
User password synchronization.
•
Automatic creation of ExtraHop accounts for users without administrator intervention.
•
Management of ExtraHop privileges based on user groups.
•
Administrators can grant access to all known users or restrict access by applying LDAP filters.
Next steps
•
Configure remote authentication through LDAP
•
Configure remote authentication through SAML
•
Configure remote authentication through
•
Configure remote authentication through RADIUS
Remote users
If your ExtraHop system is configured for SAML or LDAP remote authentication, you can create an account
for those remote users. Preconfiguring accounts on the ExtraHop system for remote users enables you to
share dashboards and other system customizations with those users before they log in.
If you choose to auto-provision users when you configure SAML authentication, then the user is
automatically added to the list of local users when they log in for the first time. However, you can create
a remote SAML user account on the ExtraHop system when you want to provision a remote user before
that user has logged in to the system. Privileges are assigned to the user by the provider. After the user is
created, you can add them to local user groups.
Содержание Trace Admin UI
Страница 1: ...ExtraHop 8 8 ExtraHop Trace Admin UI Guide...
