Create read-only accounts

Restrict each source account to the read permissions it needs. Devexana's read restrictions do not replace the account permissions that you control.

Account types by source

Switches and routers

SSH

Create an account at the lowest privilege level that permits the required read commands: show, or display on HP Comware. Devexana signs in with an SSH username and a password or a private key.

Devexana runs only read commands that pass its allowlist, and refuses shell metacharacters. The allowlist accepts these command verbs: show, display, get, cat, more, ls, ip, ifconfig, netstat, uptime, version and dir. Devexana refuses the forms of ip and ifconfig that change settings.

SNMP

SNMP access uses GET and GETNEXT requests only. Devexana sends no SNMP SET. SNMPv3 uses HMAC-SHA authentication and AES-128 privacy. Use a read-only community for SNMPv2c. If your policy requires it, restrict the SNMP view on the device.

Barracuda CloudGen firewalls

Create an SSH account on the firewall. Devexana runs one fixed batch of read commands. From the configuration, it keeps only an allowlisted set of keys. It reads no rules and no logs over SSH. Supported vendors and protocols lists what the read returns.

API sources

• Freshservice: Create an agent account for Devexana. Give it a role that can view only the records you want Devexana to read. Use that agent's API key.
• PRTG: Create a read-only PRTG user. Use that user's API token.
• Microsoft Entra ID: Register an application with read-only Microsoft Graph application permissions. Create a client secret.
• LDAP or Active Directory: Create a bind account with read access. Devexana connects over LDAPS by default.

API connectors and ticketing describes how to add an API source.

What Devexana does with a credential

• Devexana stores the credential encrypted on the appliance.
• Devexana writes a record to the audit log each time it reads a stored credential.
• The interface does not show the credential again after you save it.

Encryption and credentials describes encryption and credential storage.

Approve API read functions

For API sources, every read function stays off until an administrator approves it. Devexana records each approval in the audit log. An administrator cannot approve a write function. The audit log describes the audit log.

Switch and firewall SSH sources have no read functions to approve. The read allowlist above limits them. The LDAP and DHCP lease sources also have no read functions to approve.

SSH host keys

Devexana does not trust an SSH host key on its own. When you add a device, an administrator compares the presented fingerprint with the fingerprint from the device console. The administrator trusts the key only if the fingerprints match. Until then, SSH reads of the device fail. If the key changes, Devexana stops reading that device. If you replace a device, an administrator repeats this comparison before trusting the new key.

Who can run reads

Each signed-in user whose role includes read access can run allowlisted read commands from a switch page. The Full access and Standard roles include read access. Assign roles according to who needs permission to run these commands. Accounts, roles and sign-in describes roles.

Help with each account

Each source shows the steps to create its read-only account in the Provision access step.