(408) 943-4100               V   Commercial Support

Settings

  7 minute read.

Last Modified 2021-07-14 10:52 EDT

The Administration page shows additional system details and offers a variety of TrueCommand configuration options. This page is available to users with administrator permissions by opening the Configure menu and clicking Administration. The page is organized into About, Certificates, and Configuration tabs.

The About tab contains the current TrueCommand system ID and version, license details, and contact information for iXsystems.

AdministrationAbout

Updating the License

You can expand TrueCommand to monitor more disks by upgrading or purchasing a license from iXsystems. Clicking GET A LICENSE opens a new browser tab to purchase a TrueCommand license. You can also contact iXsystems to upgrade the current license.

After you purchase or upgrade the license, you must upload the new license to TrueCommand. Click Browse… to open a file browser on your local system. Select the new license file to upload and click UPLOAD LICENSE to apply the new license to TrueCommand.

The Certificates tab shows the certificates and Certificate Authorities (CAs) TrueCommand uses and has options to upload or import a certificate or CA.

AdministrationCertificates

Clicking Browse… opens a dialog to upload a file from the local system. Selecting Plain text allows you to copy and paste the file raw text instead of uploading a file.

The Configuration tab contains options to configure various features of TrueCommand.

Administration About

Changing any options requires clicking SAVE to save the new system configuration. To reset fields back to their previous values, click CANCEL.

General options include how frequently TrueCommand measures systems statistics, how long to store system statistics, and the number of database backups from an iXsystems NAS to store.

SSL options

This feature is only available for local installations or containerized TrueCommand deployments.

By default, TrueCommand attempts an SSL connection, then a non-SSL connection if the first attempt fails. You can disable non-SSL connection attempts by setting Require SSL for all connections. This is useful when a monitored system does not allow SSL-secured access or when the monitored system is using a custom port.

There are additional options to configure how TrueCommand handles certificates. By default, TrueCommand accepts self-signed certificates and certificate hostname mismatches. This allows the first-time login to TrueCommand and accepting certificates from systems that use a hostname, but are registered in TrueCommand with an IP address (or vice-versa).

Configure SSL

Alert Options

You can adjust the alert levels that TrueCommand shows from a connected NAS to tune the system messages shown according to your use case. Choose an alert category to ignore. Multiple categories can be selected.

LDAP

TrueCommand supports using LDAP to better integrate within an established network environment. LDAP/AD allows using single sign-on credentials from the Lightweight Directory Access Protocol (LDAP) or Active Directory (AD). This means a user can log in with an LDAP or AD account without creating a separate TrueCommand login.

The LDAP server IP address or DNS hostname and Domain are required to use LDAP/AD. The LDAP or AD Username (optional) is required when the TrueCommand user name does not match the LDAP or AD credentials.

Click on the   (Gear) > Administration.
Open the Configuration Tab to access the LDAP configuration section.

Configure LDAP

To configure LDAP, add an LDAP server IP address or DNS hostname, fill in the Domain, and click ADD SERVER. Multiple LDAP servers and Domains can be added.

Add LDAP Server

FieldValue
LDAP Server URL (string, Required)IP or DNS name of the LDAP server, with port number on the end.
Example: “ldap.mycorp.com:636” (SSL port is typically 636 for AD/LDAP)
Domain (string, Required)Base domain settings of the user.
Example: “dc=mycorp,dc=com” for a typical username@mycorp.com user account
Group Domain (string)The alternative domain setting to use when searching for groups. The Default value is the same as Domain
Verify SSL (bool)Require strict SSL certificate verification. The default value is false.
Disable this option if the hostname of the system is different than the one listed on the SSL certificate, an IP is used for the connection instead of the DNS hostname, or if a self-signed certificate is used by the LDAP server.
User ID Field (string)Domain fieldname to use for user-matching. The default value is “uid” (user ID). Another field commonly-used is “cn” (common name)
Group ID Field (string)The domain fieldname to use when searching for a group name. The default value is “cn” (common name).
BIND User Domain (string)The full domain setting for a pre-authenticated bind to the server.
Example: “uid=binduser,cn=read-only-bind,dc=mycorp,dc=com”
For an unauthenticated bind set this field to just a name (example: “truecommand-bind”). This is sometimes used for logging purposes on the LDAP, but otherwise is not validated.
Bind Password (string)The password to use for the bind user.
For an unauthenticated bind, leave this field blank while setting the BIND User Domain to a non-empty value.

LDAP connection options

TrueCommand supports two common methods of validating LDAP user credentials:

Direct Bind

The Direct Bind method uses the Domain and User ID Field to create a static domain string which is then used to authenticate the user.

Example:

  • Domain: “dc=mycorp,dc=com”
  • User ID Field: “uid”

When user “bobby.singer” attempts to login, TrueCommand will establish an SSL-secure connection to the LDAP server and then attempt to bind with the static domain “uid=bobby.singer,dc=mycorp,dc=com” and the user-provided password. If successful, then the user authentication has been verified and Bobby Singer is allowed access to TrueCommand.

Indirect Bind

The Indirect Bind authentication method is much more dynamic and searches for the proper user domain settings rather than making assumptions about the format. With TrueCommand, Indirect Bind configures a “bind user” (typically a read-only, minimal-permissions user account) with a known domain/password to perform the initial bind to the LDAP server. Once logged in, TrueCommand searches for the user domain currently requesting to login. It then attempts a second bind with the user domain and provided password.

Example:

  • Domain: “dc=mycorp,dc=com”
  • User ID Field: “uid”
  • BIND User Domain: “uid=binduser,cn=read-only-bind,dc=mycorp,dc=com”
  • BIND Password: “pre-shared-key”

When “bobby.singer” attempts to login, TrueCommand will establish an SSL-secure connection to the LDAP server. TrueCommand will use the BIND User Domain and BIND Password settings to perform an initial bind using pre-known settings from your LDAP provider. Once bound, TrueCommand will search for the user matching “uid=bobby.singer”, but only within the subdomains that include the “domain” setting (“dc=mycorp,dc=com” in this example). If TrueCommand finds a user, it will use the full user domain string from the search result to initialize a second bind along with the user-provided password. If successful, TrueCommand verifies the user authentication and Bobby Singer is allowed access to TrueCommand.

SSL/TLS Connection Info

WARNING: AD/LDAP authentication requires SSL connections.

If the LDAP server uses an SSL certificate generated by a custom certificate authority (CA), then one of two things must occur before TrueCommand can use the LDAP server:

  • (Option 1) Users must register the custom certificate authority with TrueCommand via the Certificates tab in Administrator Settings.
  • (Option 2) Users can disable the Verify SSL option to accept whatever SSL certificate the server provides. Users may need to choose Option 2 if the LDAP server hostname is different than the one listed on the certificate, or if the server uses a self-signed SSL certificate.

Enabling Allow LDAP user creation means TrueCommand creates user accounts when someone logs in to the User Interface with their LDAP credentials. JOIN TEAM automatically adds LDAP users to specific TrueCommand teams.

Enabling Allow LDAP user creation means TrueCommand creates user accounts when someone logs in to the User Interface with their LDAP credentials. JOIN TEAM automatically adds LDAP users to specific TrueCommand teams.

Telemetry

TrueCommand reports some basic usage telemetry back to iXsystems for product improvement analysis. These metrics are completely anonymous.

Click the PREVIEW button to see exactly what your system is sending.
Check the Disable Telemetry check box and click the SAVE button to disable this feature.