hello guys;
i want only allow certain services for a user
1.5.0p24.cre
thank you
You can assign a contact group to this service and then you can say that the member is only allowed to see the services he is contact for.
Hi Andreas, I’m having a similar problem.
I have created a contact group, I have assigned the services to that contact group and I have selected the option for the user to only see hosts and services that he is contact for. After this that user can only see the selected services but not the Hosts. So I have added the hosts to the contact group, but with this option the user see every service of the host no matter if that service is assigned to another contact group.
Is there a way to show all hosts but when you get inside one the system only shows the selected services?
Thanks in advance
That is a little bit complicated.
The key are the authorization settings of the livestatus.
There are two possible settings for your scenario.
Authorization setting for hosts - strict - you must be contact for a service on a host
and the other one is - loose - contacts for hosts see all services.
How to configure.
CEE - inside WATO - global settings - monitoring core - authorization settings
CRE - you need to modify your livestatus broker module - [Check_mk (english)] OMD and MK_Livestatus service_authorization Variable
Some old post by myself 
Pay attention this option is for the complete system and alle users then ative.
I don’t know if you want this. If you set this option you should also play around with the option inside WATO “user can see all objects”.
Thanks for your reply. I have seen this solution in another post and at the manual https://checkmk.com/cms_wato_user.html but I was looking for the Wato solution in my CRE version 
With your info I have added service_authorization=strict to the nagios.cfg project file and now is working.
Thanks a lot!
Dear guys
@Nha-Krul you can Send more detail.
I’m still looking for the solution
Best regards
Hi abdou.
If you are using the RAW version you have to add the service_authorization=strict variable inside the nagios.cfg file.
I’m using check_mk 1.6.0p8 version, but I think that must be the same for yours.
Use a ssh console to connect to your check_mk server. Then you have to change to your project mk-livestatus directory.
In my case is root@checkmk-server:/omd/sites/Test/etc/mk-livestatus/
Inside this folder you will have the nagios.cfg file. Edit this file using nano or vim and inside the line “broker_module” you need to add the variable.
In my case:
broker_module=/omd/sites/Test/lib/mk-livestatus/livestatus.o num_client_threads=20 mk_logwatch_path=/omd/sites/Test/var/check_mk/logwatch mk_inventory_path=/omd/sites/Test/var/check_mk/inventory pnp_path=/omd/sites/Test/var/pnp4nagios/perfdata service_authorization=strict /omd/sites/Test/tmp/run/live
Save and exit.
At last you need to restart your project, for this use omd command.
For my project: root@checkmk-server: omd reload Test
Now you have to crate the Contact Groups, and then add the Hosts and the Services to that contact groups.
Wato -> Contact Groups (to create the Contact Group)
Wato-> Host and Service Parameters -> Grouping -> Assignment of hosts to contact groups
Wato-> Host and Service Parameters -> Grouping -> Assignment of services to contact groups
At last you have to create the user and add it to the Conctact Group. This option is inside the user configuration page. And change the Visibility of Host and Services to Only show hosts and services the user is a contact for.
I think I did’t forget anything.
I have a Test project with one server and two users to try all this configuration.
1 Like
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.